How a rootkit hides a connection

TL;DR: Three Linux rootkits use eBPF's own helpers to edit what your tools report. One rewrites a single number so ss steps right over a hidden connection. Plus: a new IAM Identity Center toggle that AWS says you cannot scope down.

Lorenzo Susini and Matt Muir, Datadog Security Labs [2026-07-27].

Run ss and you don't get the kernel's data. You get a chain of reply messages the kernel wrote into a buffer in your process. Each entry starts with its own size, and the tool walks the chain by jumping forward by that number.

VoidLink edits one number in that buffer, in the gap after the kernel fills it and before ss reads it. Entry A is 48 bytes. The entry hiding port 4444 is 64. A's size becomes 112. The cursor jumps from 0 straight to 112, the hidden entry gets walked as padding, and the forged size still fits the buffer so no length check trips.

Your socket list comes back short by one connection, and nothing an operator would notice.

Two more in the same teardown. LinkPro forces bpf_override_return(ctx, -ENOENT) when the next eBPF program ID belongs to it, so enumeration stops one entry early. Atomic Arch calls bpf_send_signal(9) on PTRACE_ATTACH, and the SIGKILL lands on the caller, so your debugger dies and the target keeps running.

Why this is a cloud problem. All three are post-compromise. But eBPF has no namespace, so a sidecar holding these capabilities is already operating on the host kernel. Your CNI has them. Your runtime agent has them. Your APM profiler probably does too.

LinkPro landed exactly this way, on AWS infrastructure, after CVE-2024-23897 on an exposed Jenkins server.

One caveat. Check Point said in January 2026 it had seen no real-world infections. Cisco Talos reported victims a month later, dating back to September 2025, while noting it "cannot discount the possibility that this activity is part of red team exercises."

Ship this week. Audit which workloads hold CAP_SYS_ADMIN on your nodes. Grep privileged: true and capabilities.add both, since the first grants the set without naming it. That closes the BPF path to writing another process's memory and leaves CAP_SYS_PTRACE untouched, so scope the claim honestly.

Datadog's three rules fire on the program-load event:

Read the syntax before copying it. That's Datadog's Workload Protection sensor, and bpf.prog.helpers is the part your tooling probably lacks. The helper set is derived from the program's instructions, so reproducing this means building that extraction yourself. That's the cost these three tidy lines hide.

Expect legitimate hits. Commercial EDR uses these helpers too.

Find out which apps hold your engineers' AWS access. On June 30, 2026 AWS shipped account access for customer managed applications. Aidan Steele walked it the next day.

A user signs in to your IdP, the app exchanges that JWT via CreateTokenWithIAM, then enumerates and requests credentials for the roles that person holds. Neither piece is new. What changed is that an admin can now switch the scope on for an app you wrote.

AWS's own warning: "that application can access all accounts and roles available for an authenticated user through their permission set assignments. You cannot restrict the application to specific accounts or roles."

CloudTrail correlates most of the chain. What no field tells you is which application made the call.

Do this this week. Alert on CreateTokenWithIAM from any client ID you don't recognise, then inventory:

Anything carrying sso:account:access holds every account its users hold.

Aidan Steele on the new STS roles claim [2026-07-13]. AWS publishes sts:RoleAuthorizedByIdp as a Bool scoped to AssumeRoleWithWebIdentity. Per Steele's testing, an IdP can name which roles a token may assume and STS checks that ahead of the trust policy. Everything past the key's existence comes from his own trial and error, so reproduce it before you build on it.

R.K.

Every manager faces the same situations before lunch: a message to land, a meeting to run, a hiring call, a report due. The AI Report built 37 Claude prompts for exactly those moments, organised by the situations every manager faces. 

Copy the prompt, fill the brackets, run it in Claude, and get back 10+ hours a week. Oh, and it's free. 

All you have to do is subscribe to The AI Report, a 5-minute daily AI brief read by 400,000+ business leaders at IBM, AWS and Microsoft, and the full prompt pack lands in your welcome email. The newsletter and the prompts, both free. Subscribe and grab both

Subscribe and get 37 prompts free