Executive Summary
In October 2025, security researchers from Synacktiv revealed the discovery of LinkPro, a sophisticated GNU/Linux rootkit targeting AWS-hosted infrastructure. The attackers leveraged advanced eBPF techniques to install two modules: one for stealth, allowing the malware to evade detection, and another granting remote access via specially crafted TCP packets (magic packets). This backdoor enabled threat actors to persist undetected, hide their presence, and maintain control of compromised systems in cloud environments, posing severe risks to the underlying business operations and data confidentiality of affected organizations.
This incident highlights the escalating use of kernel-level and cloud-specific attack techniques, exploiting eBPF to bypass traditional defenses. The campaign underscores a growing trend of attackers utilizing cloud-native technologies to achieve stealth and persistence, raising urgent concerns for CISOs overseeing both public cloud and Linux workloads.
Why This Matters Now
LinkPro demonstrates how attackers exploit advanced Linux kernel features like eBPF to create highly evasive rootkits, making existing security controls obsolete in some cloud environments. With the adoption of cloud-native and hybrid infrastructures accelerating, organizations must urgently update detection and response strategies against modern, kernel-level threats before similar tactics proliferate.
Attack Path Analysis
The attacker gained an initial foothold in the AWS-hosted Linux environment by leveraging a vulnerability or misconfiguration to deliver and install the LinkPro rootkit. Next, privileges were escalated—likely via exploitation of kernel-level eBPF functionality, allowing the rootkit to gain persistent control. The rootkit then enabled lateral movement across workloads, potentially by hiding its activity and using internal east-west network paths. For command and control, LinkPro leveraged 'magic TCP packets' and covert channels to maintain communication with its operators while remaining hidden. Data exfiltration is likely achieved through encrypted or covert network channels, given the rootkit’s focus on stealth. Finally, the attacker ensures ongoing persistence and impact by maintaining concealment, possibly enabling future payload deployment or disruptive actions.
Kill Chain Progression
Initial Compromise
Description
Attacker exploited a vulnerability or misconfiguration in the public-facing AWS Linux instance to deploy the rootkit.
Related CVEs
CVE-2024-23897
CVSS 9.8Jenkins 2.442 and earlier, LTS 2.426.2 and earlier does not escape the error message for the 'Expect' header in HTTP responses, resulting in a reflected cross-site scripting (XSS) vulnerability.
Affected Products:
Jenkins Jenkins – 2.442 and earlier, LTS 2.426.2 and earlier
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Rootkit
User Execution
Create or Modify System Process: Windows Service
Process Injection: Dynamic-link Library Injection
Container Administration Command
Impair Defenses: Indicator Blocking
Obfuscated Files or Information
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Implement automated audit trails for all system components
Control ID: 10.1.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (EU Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Art. 9
CISA Zero Trust Maturity Model 2.0 – Continuous Monitoring and Threat Detection
Control ID: Visibility and Analytics
NIS2 Directive – Technical and Organizational Measures
Control ID: Art. 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Linux rootkits using eBPF targeting AWS infrastructure pose critical threats to IT service providers managing cloud workloads and requiring comprehensive east-west traffic security.
Financial Services
Banking systems on Linux/AWS face severe compliance risks from stealthy rootkits bypassing traditional detection, threatening PCI DSS and encrypted transaction data protection.
Health Care / Life Sciences
Healthcare AWS environments vulnerable to eBPF-based persistence attacks threatening HIPAA compliance through compromised patient data systems and lateral movement capabilities.
Government Administration
Government cloud infrastructure faces sophisticated state-level rootkit threats requiring enhanced zero trust segmentation and anomaly detection for critical system protection.
Sources
- LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packetshttps://thehackernews.com/2025/10/linkpro-linux-rootkit-uses-ebpf-to-hide.htmlVerified
- LinkPro: eBPF rootkit analysishttps://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysisVerified
- Jenkins Security Advisory 2024-01-24https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3201Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west traffic controls, inline threat detection, and strict egress policies would have significantly limited the attacker's ability to compromise, persist, move laterally, and exfiltrate data. Real-time workload-level controls, anomaly detection, and unified visibility would have enabled earlier detection and containment of the eBPF rootkit.
Control: Cloud Firewall (ACF)
Mitigation: Inbound exploitation attempts are prevented at the network perimeter.
Control: Threat Detection & Anomaly Response
Mitigation: Suspicious privilege escalation or kernel module loading generates alerts.
Control: Zero Trust Segmentation
Mitigation: Lateral movement between workloads is blocked or promptly detected.
Control: Inline IPS (Suricata)
Mitigation: Malicious command and control channels are detected and disrupted.
Control: Egress Security & Policy Enforcement
Mitigation: Unapproved outbound exfiltration channels are blocked or logged.
Ongoing malicious persistence is rapidly detected and responded to.
Impact at a Glance
Affected Business Functions
- Continuous Integration/Continuous Deployment (CI/CD) pipelines
- Software development operations
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of source code repositories and sensitive build artifacts due to unauthorized access to the Jenkins server.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce cloud firewall and microsegmentation policies to reduce external and internal attack surfaces.
- • Deploy inline threat detection and anomaly response to catch abnormal privilege escalation and kernel manipulations in real time.
- • Restrict and monitor east-west traffic with zero trust segmentation and centralized visibility across all cloud workloads.
- • Implement strict egress filtering to block or log unauthorized outbound connections and detect covert exfiltration attempts.
- • Continuously baseline normal network and system behavior to enable faster detection of stealthy rootkit techniques leveraging eBPF or other advanced persistence methods.
