NEWS

eBPF Rootkits: Why Underground Actors Are Taking Notice

Flare research shows Linux eBPF rootkit code and tutorials spreading on underground forums, with stealth that evades lsmod checks and many EDR tools.

Dylan H.

News Desk

November 11, 2026
3 min read
eBPF Rootkits: Why Underground Actors Are Taking Notice

Overview

Research from Flare (published via a sponsored BleepingComputer article) finds that Linux eBPF rootkit techniques are moving from conference talks into underground forums, where actors share source code, tutorials, and exploits targeting Linux systems.

Why eBPF Appeals to Attackers

  • eBPF programs run in the kernel without a kernel module, so lsmod checks can miss them.
  • They use the same bpf() interface as legitimate tools such as Cilium and pass the kernel verifier, so they resemble approved programs.
  • They can hook kernel functions, observe syscalls, and inspect or modify network traffic.

Notable eBPF and BPF Malware

ToolNotes
BPFDoorPassive backdoor attributed to a Chinese actor (Red Menshen); uses classic BPF socket filters triggered by crafted packets
SymbiotePreloaded shared library that hijacks setsockopt() to hide traffic from packet capture
ebpfkitPresented at Black Hat USA and DEF CON in 2021
TripleCrossCombines syscall hooks with XDP and traffic control for injection, hiding, and C2
BoopkitHooks getdents64 to hide directory entries; remotely triggerable
LinkProReported by Synacktiv in October 2025 after an intrusion via an exposed Jenkins server; tried to hide programs from bpftool prog list

Underground Activity

  • A Russian-language tutorial on the Duty Free forum cites BPFDoor and Symbiote as influences and covers packet-triggered activation, process hiding, encrypted C2, and XDP-based filtering that targets a list of antivirus-associated IPs.
  • Flare found 10 related Pastebin posts containing XDP code and timing thresholds.
  • The most reposted exploit, seen on at least six platforms, targets CVE-2017-16995, a 2017 BPF verifier sign-extension flaw.
  • A fresh, unverified privilege escalation PoC targets kTLS and eBPF sockmaps; its claimed kernel compatibility is incorrect.
  • One exploit sample's author credited Claude in a code comment for generating the BPF instructions.

Detection and Hardening

  1. Audit loaded eBPF programs regularly with bpftool prog list and know what should be present.
  2. Restrict access: set kernel.unprivileged_bpf_disabled=1 and limit CAP_BPF and CAP_NET_ADMIN.
  3. Monitor bpf() syscalls and attachment points on sensitive syscalls such as getdents64 and execve.
  4. Watch for unexpected XDP programs on network interfaces.
  5. Look for magic-packet activation, since several backdoors trigger on specific TCP flags or window sizes.
  6. Compare multiple telemetry sources. Since a rootkit can hide from a single view (as LinkPro tried to), cross-check bpftool output with BPF maps and links.
  7. Patch kernels promptly. BPF verifier bugs recur and public exploits appear quickly.

Note that the source is vendor-sponsored content, and the defensive measures it describes are largely reactive.

Sources