In recent months, Cisco Talos has identified a new modular malware framework referred to as VoidLink. The framework was discovered to have been utilized and developed by a previously disclosed actor, now attributed as UAT-9921. Based on other data, it appears that UAT-9921 has been operating since 2019; however, the actual framework of VoidLink was likely built over the last few months leading up to its first usage on September 25, 2025.
VoidLink is unique in many aspects; it utilizes the Zig programming language for the main implant, C programming language for its plugins, and the Go language for its back-end command and control server while allowing for on-demand compilation of each plugin depending on the target's unique Linux distribution. This flexibility lets operators drop exactly the right tool for the target environment without carrying a bloated binary.
The framework is purpose-built for stealthy, long-term persistence in Linux-based cloud environments (think AWS, Azure, GCP instances). It includes:
1. Rootkits at the kernel level that provide a way to hide processes, files, and network activities from detection.
2. Anti-forensics and anti-analysis methods to determine whether the current environment is a sandbox or debugging tool through locating typical EDR hooks that all work in similar ways.
3. Dynamic evasion via querying the C2 of all existing plugins and tailoring them based upon what was found (e.g., specific database readers, exploits for internal web applications).
4. Create-the-plugin-on-demand by building a brand new plugin at the server each time it is required.
5. Role-based Access Control (RBAC) with three distinct roles (SuperAdmin, Operator, Viewer), indicating a high level and type of production quality access and possibly even providing for some type of oversight/audit trail.
6. SOCKS proxy deployment on compromised hosts for internal scanning and lateral movement (often paired with open-source tools like Fscan)
Talos also spotted signs of a Windows variant (still in PoC stage) that uses DLL side-loading to load plugins, hinting at broader ambitions beyond Linux cloud targets.
The actor's technique of compromising hosts as a platform to place VoidLink Command and Control (C2) before then pivoting to scanning (both externally [which is legitimately or internally]] allows them to hide their presence among blended traffic patterns to remain unnoticed.
Attribution Notes
1. Chinese language identifiers exist within code comment strings ([input into the runtime context]) and in direct calls within the framework strings; therefore, indicating a possibility that operations are being executed by Chinese developers/operators.
2. Development appears to be split between two different teams where one is responsible for creating the overall framework (presumably with LLM support used for generating specifications driving code), while the other team deals with executing the operational side.
3. The operators [of this malicious infrastructure] have both access [to legitimate methods] and partial source code associated with some of the kernel modules executed by the implants and additional offline tools associated with direct methods of accessing the implants; therefore indicating either a very close relationship between the two teams or using common infrastructure to get operational advantage.
Timeline and Victimology:
1. Earliest identified occurrence of VoidLink activity recorded is back in September 2025.
2. The first official report on VoidLink came out in November 2025, but there are no records of any prior incidents of its use.
3. The group has focused its activity mainly on both tech and financial sectors; however, they have mainly targeted cloud hosted Linux systems in these sectors.
Expert Commentary
When asked about the timeline discrepancy, Check Point’s Pedro Drimel Neto told The Hacker News they haven’t independently verified pre-September 2025 activity and are limited to their own datasets.
Ontinue’s analysis earlier this week flagged a broader concern: LLM-assisted malware development (as appears to have happened with VoidLink) dramatically lowers the skill floor for creating sophisticated, hard-to-detect implants. Combine that with kernel rootkits and cloud-native evasion, and the barrier to entry for serious cloud espionage drops sharply.
Talos describes VoidLink as “near-production-ready” and warns it’s positioned to evolve quickly , especially with its compile-on-demand and plugin architecture.
If you operate cloud Linux workloads (especially in tech/finance), treat this as a wake-up call. Important measures for protection and hardening of your system include:
1. Look out for abnormalk kernal module loads, irregular process trees and the presence (or absence) of SOCKS Proxy Listener.
2. Be on the look out for any Zig compiled binaries or binary files that are c2 related (command and control) in origin using Go in your environment.
3. Ensure that you perform thorough egress filtering and do not permit outbound communication from servers which were not requested by the server's respective application (i.e., do not allow requests from an application that did not originate with that application).
4. Use runtime security tools such as Falco, Sysdig, or Tetragon to monitor for changes in kernel configurations as well as identify any odd process executions.
5. Conduct a more vigorous audit of your Identity and Access Management roles (IAM) and Cloud API keys (e.g., AWS, Google, Azure) because VoidLink often travels through compromised accounts.
Source: The Hacker News
