[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5Bu0FnQyh5jcLuaOxA19MP-lYJSg1d-XV9tELGgertk":3},{"article":4,"iocs":50,"watch_terms":69,"solutions":70,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f884e49c-1777-4850-85f7-e027f72f0f01","eBPF Rootkits: Why Underground Actors Are Taking Notice","ebpf-rootkits-why-underground-actors-are-taking-notice-acc7a2","Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems. [...]","Threat actors are increasingly adopting eBPF (extended Berkeley Packet Filter) technology for creating rootkits on Linux systems. Unlike traditional rootkits that rely on kernel modules, eBPF rootkits can hide malicious activity and evade detection by hooking kernel functions without loading modules. Flare's research indicates that source code, tutorials, and exploits for these eBPF rootkits are being shared on underground forums, with examples like BPFDoor and Symbiote already documented.","Linux eBPF rootkits are spreading via underground forums, sharing code and tutorials.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Febpf-rootkits-why-underground-actors-are-taking-notice\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F11\u002F08\u002Febpf-header-image.jpg","2026-11-11T15:01:11+00:00","2026-11-11T16:00:20.715581+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"eBPF","technology",{"name":21,"type":22},"Flare","vendor",{"name":24,"type":25},"Red Menshen","threat_actor",{"name":27,"type":22},"PwC",{"name":29,"type":22},"Elastic Security Labs",{"name":31,"type":22},"Intezer","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,57,60,63,66],{"type":36,"value":52,"context":53},"BPFDoor","A passive Linux backdoor attributed to a Chinese threat actor.",{"type":36,"value":55,"context":56},"Symbiote","Linux malware that weaponizes BPF for stealth.",{"type":36,"value":58,"context":59},"ebpfkit","A rootkit presented at Black Hat USA and DEF CON.",{"type":36,"value":61,"context":62},"TripleCross","Combines syscall hooks with XDP and traffic control programs for various malicious functions.",{"type":36,"value":64,"context":65},"Boopkit","Uses getdents64 hooks to hide directory entries.",{"type":36,"value":67,"context":68},"LinkPro","Used eBPF programs to hide activity and activate a backdoor.",[21,27,29],{"controls":71,"vendors":148},[72,101,120],{"slug":73,"name":74,"problem":75,"products":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":102,"name":103,"problem":104,"products":105},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[106,107,115],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":116,"product_name":117,"url":118,"description":119},"cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"slug":49,"name":121,"problem":122,"products":123},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[149],{"slug":78,"name":79,"logo_path":80,"roles":150},[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"ebpf-rootkits-a-stealthy-new-threat-evading-traditional-linux-defenses","eBPF Rootkits: A Stealthy New Threat Evading Traditional Linux Defenses","Threat actors are weaponizing eBPF technology to build rootkits that hook directly into kernel functions without loading detectable kernel modules, allowing them to hide processes, network traffic, and malicious activity from conventional security tools. Because eBPF operates within a privileged but nominally legitimate kernel subsystem, many endpoint detection and monitoring solutions fail to flag its misuse. The active sharing of source code and tutorials on underground forums accelerates the proliferation of these techniques, lowering the barrier for less sophisticated actors. Organizations relying solely on traditional rootkit detection methods are now blind to an entire class of threat that is already deployed in the wild via tools like BPFDoor and Symbiote.",[157,158,159,160,161],"MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1543: Create or Modify System Process","CIS Control 10: Malware Defenses (v8)","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events",{"MITRE ATT&CK T1014: Rootkit":163,"CIS Control 10: Malware Defenses (v8)":164,"MITRE ATT&CK T1543: Create or Modify System Process":165,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":166,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":167},"BPFDoor and Symbiote directly implement rootkit techniques by using eBPF to hide malicious processes and network connections from the operating system and security tools.","CIS Control 10 requires deploying anti-malware tools capable of detecting rootkits; eBPF rootkits evade tools that do not inspect kernel hook points, exposing the gap this control targets.","eBPF rootkits hook kernel functions at a privileged level to persist and manipulate system behaviour, mirroring the persistence and privilege abuse this technique describes.","SI-7 requires monitoring the integrity of software and kernel components, which would surface unauthorized eBPF programs hooking kernel functions.","Continuous monitoring of network activity and kernel-level events is precisely what eBPF rootkits subvert, making this category directly relevant to detecting their hidden communications."]