VOIDLINK: THE CLOUD-NATIVE MALWARE FRAMEWORK

Summary from the TLDR InfoSec newsletter

VoidLink is a sophisticated Zig-based Linux malware framework from Chinese-affiliated developers. It features a cloud-first design that detects AWS, GCP, Azure, Alibaba, and Tencent environments and adapts its behavior based on detected EDRs and security controls. The framework includes 37+ plugins inspired by Cobalt Strike's BOF architecture, environment-adaptive rootkit deployment (LD_PRELOAD, eBPF, or LKM-based on the kernel version), and multiple C2 channels, including HTTP, DNS tunneling, ICMP, and P2P mesh networking. VoidLink's credential-harvesting targets cloud environments, Git repositories, and SSH keys, suggesting that software engineers and cloud infrastructure are primary targets for espionage or supply chain attacks.