Researchers found a sophisticated malware framework called VoidLink that targets Linux machines, particularly in cloud environments. It has over 30 customizable modules for reconnaissance, privilege escalation, and stealth, indicating a shift towards targeting Linux systems by professional threat actors.

VoidLink is a sophisticated malware framework targeting Linux systems, designed for stealthy, long-term access in cloud environments. It features a flexible architecture with over 30 plugins, capable of adapting its behavior based on the detected environment and employing various evasion techniques. The framework is linked to Chinese-affiliated developers and shows signs of rapid evolution.

A new rootkit leveraging the io_uring interface has been discovered, capable of bypassing traditional Linux security measures. This malicious software operates at a low level, allowing it to evade detection and maintain persistence on infected systems, raising significant concerns for system administrators and security professionals.

A new Linux malware called "Plague" has been discovered, allowing attackers persistent SSH access while evading traditional detection methods for over a year. It employs advanced obfuscation techniques and environment tampering to eliminate traces of malicious activity, making it particularly difficult to identify and analyze. Researchers emphasize its sophisticated nature and the ongoing threat it poses to Linux systems.

A Rust-based Linux kernel module for rootkit detection was developed during an internship at Thalium to enhance malware detection capabilities in various Linux environments. The article discusses the importance of detecting kernel rootkits and outlines the tools and techniques used for this purpose, including leveraging the Linux kernel's tracing APIs and the limitations of existing malware detection solutions.

The article discusses a Linux-based cryptominer that has been discovered, detailing its operation and potential impact on system performance and security. It also highlights the methods used by the malware to hide its presence and evade detection. Users are advised to take necessary precautions to protect their systems from such threats.

A new campaign utilizing ClickFix attacks is now targeting both Windows and Linux systems, with the threat group APT36 adapting social engineering tactics to trick users into executing malicious commands. The Linux variant involves redirecting victims to a CAPTCHA page that prompts them to run a benign command, potentially paving the way for future attacks. Users are advised to avoid executing unknown commands to mitigate the risk of malware infections.

A new Linux malware named Koske uses seemingly harmless panda JPEG images to deploy sophisticated malware directly into system memory, leveraging vulnerabilities in exposed JupyterLab instances. The malware, believed to be developed with AI assistance, deploys cryptocurrency miners and employs advanced tactics to maintain persistence and evade detection. Researchers warn that the adaptability of Koske could lead to even more dangerous variants in the future.