eBPF Rootkits: Why Underground Actors Are Taking Notice
Linux eBPF rootkits are spreading via underground forums, sharing code and tutorials.
Threat actors are increasingly adopting eBPF (extended Berkeley Packet Filter) technology for creating rootkits on Linux systems. Unlike traditional rootkits that rely on kernel modules, eBPF rootkits can hide malicious activity and evade detection by hooking kernel functions without loading modules. Flare's research indicates that source code, tutorials, and exploits for these eBPF rootkits are being shared on underground forums, with examples like BPFDoor and Symbiote already documented.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Flare?
Get an email when a new story names Flare, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are weaponizing eBPF technology to build rootkits that hook directly into kernel functions without loading detectable kernel modules, allowing them to hide processes, network traffic, and malicious activity from conventional security tools. Because eBPF operates within a privileged but nominally legitimate kernel subsystem, many endpoint detection and monitoring solutions fail to flag its misuse. The active sharing of source code and tutorials on underground forums accelerates the proliferation of these techniques, lowering the barrier for less sophisticated actors. Organizations relying solely on traditional rootkit detection methods are now blind to an entire class of threat that is already deployed in the wild via tools like BPFDoor and Symbiote.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — BPFDoor
- malware — Symbiote
- malware — ebpfkit
- malware — TripleCross
- malware — Boopkit
- malware — LinkPro