eBPF rootkits shared on underground forums target major Linux servers
Underground forums are now distributing eBPF rootkit source code, tutorials and exploits that can hide malicious activity without loading kernel modules. The tools allow process hiding and packet‑triggered activation, making detection by traditional lsmod checks ineffective. Companies operating Linux servers, including Google, Cloudflare and Meta, face increased risk from these threats. The Flare team continues to monitor forums, marketplaces and paste sites in real time to track emerging eBPF weaponry.
Key facts
- Flare reports the rootkits can hide activity without loading kernel modules.
- A Russian‑language post details building an implant with process hiding and packet‑triggered activation.
- eBPF programs run without kernel modules, so lsmod checks may miss them.
- Linux servers used by Google, Cloudflare and Meta are specifically mentioned as at risk.
- Flare monitors forums, marketplaces and paste sites in real time for new eBPF tools.
Summarised with AI from 1 sourceRead our AI policy
Why it matters
Undetected eBPF rootkits could compromise critical internet infrastructure.
What changed
First published from BleepingComputer