eBPF Rootkits: How Linux Technology Became a Cybercriminal Tool

From Innovation to Threat

For years, eBPF (extended Berkeley Packet Filter) has been regarded as one of the most efficient and useful technologies within the Linux kernel. It allows developers to run sandboxed programs directly at the kernel level, simplifying network monitoring and security system management. However, what serves as a convenience for developers has become a highly effective weapon for cybercriminals.

Traditionally, Linux rootkits relied on Loadable Kernel Modules (LKM), which were easily detected by security systems. With eBPF, the situation is radically different. Because these programs do not load as separate modules, standard tools like lsmod cannot see them. Consequently, malicious code utilizes kernel functions as if it were a legitimate program.

The Threat Is Now on Forums

While the use of eBPF for attacks was previously discussed only in academic circles and at conferences, the situation has changed. Security researchers have discovered that detailed instructions and ready-made code for creating eBPF rootkits are now circulating on Russian-language hacking forums. One such guide teaches users how to hide processes, activate an "implant" via specially crafted network packets, and encrypt command channels using the AES-256-GCM algorithm.

This trend was first confirmed by the emergence of malware such as BPFDoor and Symbiote. For instance, LinkPro, discovered in October 2025, used eBPF to mask its activity on a host system, activating only upon receiving specifically crafted network packets. This approach renders it invisible to many standard security tools.

How to Protect Yourself

The primary issue with eBPF-based threats is that they pass the kernel's built-in verifier. If a program successfully passes the check, the system perceives it as trustworthy. Nevertheless, administrators can take specific steps to protect Linux servers:

• Regular Audits: Use the bpftool prog list command to regularly check which eBPF programs are running and whether they align with your expectations.
• Restrict Access: Set kernel.unprivileged_bpf_disabled=1 and limit CAP_BPF and CAP_NET_ADMIN privileges.
• Network Monitoring: Watch for unusual network packets, as many such "backdoors" are triggered by specific changes in TCP flags or packet sizes.
• Updates: Vulnerabilities found in the kernel verifier are regularly exploited by attackers, making timely system updates critical.

eBPF rootkits represent a new stage in Linux security. Since they operate through legitimate mechanisms permitted by the kernel, defense requires not only automated scanning but also a deeper, more complex analysis of system telemetry.