CVE-2017-16995

eBPF Rootkits Spread Underground with Code for Stealthy Linux Implants

eBPF technology, long praised for legitimate Linux kernel observability and networking, is now being weaponized by underground actors to create rootkits that evade traditional detection. Flare research uncovered Russian-language forum posts on Duty Free sharing full source code and tutorials for implants that hide processes via getdents64 hooks, activate via crafted TCP SYN packets, and encrypt C2 traffic with AES-256-GCM. Historical examples include BPFDoor used by Red Menshen, Symbiote’s dynamic linker preload technique, and the more recent LinkPro discovered by Synacktiv after a Jenkins compromise. Public research tools such as ebpfkit, TripleCross, and Boopkit demonstrated the same capabilities years earlier at Black Hat and DEF CON. Defenders are advised to restrict unprivileged BPF access, regularly audit programs with bpftool, and monitor for unexpected XDP attachments and magic packets.