Flare reports underground eBPF rootkit tutorials shared

Security researchers have observed underground threat actors increasingly sharing eBPF rootkit code and step-by-step tutorials on forums, signaling an evolution in Linux malware. Unlike traditional kernel modules, eBPF-based threats operate through legitimate kernel interfaces, allowing them to evade conventional detection checks. Defenders are advised to audit loaded programs, restrict unprivileged eBPF access, and monitor for unexpected XDP programs. Open article →