LinkPro eBPF Rootkit Deployment in AWS and Linux Environments

A sophisticated cyberattack targeted AWS-hosted infrastructure, specifically exploiting a vulnerable Jenkins server to gain initial access. The attackers leveraged CVE-2024-238976 to move laterally into AWS Elastic Kubernetes Service (EKS) clusters, where they deployed a malicious Docker image named kvlnt/vv. This image contained a Rust-based downloader, vGet, which was used to retrieve an encrypted vShell backdoor payload from an Amazon S3 bucket. The threat actors achieved persistence and escalated privileges by exploiting container escape vulnerabilities, particularly through host filesystem mounts. Once inside the environment, the attackers installed the LinkPro rootkit, a Golang-based malware designed for GNU/Linux systems. LinkPro embeds four ELF binaries, including two eBPF modules called 'Hide' and 'Knock', a shared library (libld.so), and an unused kernel module (arp_diag.ko). The Hide module uses tracepoint and kretprobe hooks on getdents and sys_bpf to conceal files, processes, and its own BPF maps, effectively evading detection by tools such as bpftool. The Knock module listens for specially crafted TCP 'magic packets' (SYN packets with a window size of 54321) to activate its command and control (C2) listener, redirecting traffic to a hidden port (2233) and bypassing firewalls and log monitoring. If eBPF is unavailable due to kernel restrictions, LinkPro falls back to using the LD_PRELOAD technique, installing a malicious shared library to hook libc functions and hide its presence in user space. Persistence is further maintained by masquerading as systemd-resolved, creating deceptive files and unit configurations to blend in with legitimate system processes. Once operational, LinkPro provides attackers with full remote shell access, file manipulation capabilities, SOCKS5 proxy tunneling, and DNS/HTTP-based C2 communications. The infection chain demonstrates advanced techniques for both initial compromise and stealthy long-term access, including the use of encrypted payloads, container escape, and kernel-level rootkit functionality. The campaign highlights the growing abuse of eBPF technology by threat actors to evade traditional security controls and maintain covert access to cloud and Linux environments. Indicators of compromise and YARA rules have been published to aid in detection and response. The incident underscores the importance of securing CI/CD pipelines, monitoring for unusual container activity, and hardening Linux kernel configurations against eBPF abuse. No definitive attribution has been made regarding the threat actors behind this campaign. The attack serves as a warning for organizations leveraging cloud-native technologies and underscores the need for robust monitoring and incident response capabilities.