Underground actors adopt eBPF Linux rootkits for evasion

Threat actors are increasingly using eBPF (extended Berkeley Packet Filter) rootkits to hide malicious activity on Linux systems while evading traditional detection methods. Unlike traditional rootkits, eBPF malware runs without loading kernel modules, making it harder to detect. Security researchers at Flare discovered the techniques spreading through underground forums, where attackers share rootkit source code, tutorials, and exploits targeting Linux infrastructure.