LinkPro: An eBPF-Based Rootkit Hiding Malicious Activity on GNU/Linux

Cybersecurity: LinkPro Linux Rootkit Analysis

Security researchers from Synacktiv CSIRT have identified a sophisticated Linux rootkit known as LinkPro, which utilizes eBPF (extended Berkeley Packet Filter) technology to maintain persistent backdoor access while avoiding detection by traditional monitoring tools.

The infection chain began with the exploitation of a vulnerable Jenkins server exposed to the internet, specifically through CVE-2024-23897. Threat actors used this access point to deploy a malicious Docker image named "kvlnt/vv" across multiple Amazon EKS (Elastic Kubernetes Service) clusters.

The containerized payload included a Kali Linux base image with three key components:

A bash startup script A VPN server program called "vnt" for proxy capabilities A Rust-based downloader malware named "vGet"

The malware represents a significant evolution in Linux-targeted threats, combining advanced stealth capabilities with flexible operational modes to compromise GNU/Linux systems across cloud infrastructure.

Advanced eBPF-Based Stealth Mechanisms

LinkPro employs a dual-layer concealment strategy using two distinct eBPF modules. It embeds four ELF modules: a shared library, a kernel module, and two eBPF modules:

The "Hide" module implements eBPF programs of Tracepoint and Kretprobe types to intercept critical system calls, filtering directory listings and concealing process directories under /proc. The second eBPF module, "Knock," enables magic packet activation for passive backdoor mode and facilitates port redirection.

These modules leverage advanced techniques to remain undetected, such as intercepting system calls and modifying the /etc/ld.so.preload configuration file to conceal network traces and filesystem artifacts.

Magic Packet Activation and Port Redirection

The "Knock" module contains two eBPF programs, xdp_ingress and tc_egress, which enable magic packet activation and port redirection. The xdp_ingress program monitors incoming traffic for a specific TCP SYN packet, allowing for seamless communication by modifying destination ports.

This advanced port redirection complicates forensic analysis and the correlation between firewall logs and actual network activity.

LinkPro achieves persistence by disguising itself as the systemd-resolved service. It copies its executable to /usr/lib/.system/.tmp~data.resolveld and creates a systemd unit file to ensure automatic execution at system boot.

The rootkit supports both reverse (passive) and forward (active) operational modes, providing extensive remote access functionality.

Based on reporting by GBHackers.