Flare’s research found a Russian-language forum tutorial that describes activating an implant with a TCP SYN packet using a specific window size, hiding processes via getdents64 hooks, and encrypting command-and-control traffic with AES-256-GCM.
Why eBPF changes the rootkit playbook
Extended Berkeley Packet Filter (eBPF) lets developers run sandboxed programs inside the Linux kernel without writing loadable kernel modules (LKMs). That capability, long celebrated for legitimate uses such as network monitoring and security tooling, also gives attackers a new avenue to observe and manipulate system activity through the kernel’s sanctioned bpf() interface.
Traditional detection techniques focus on watching for suspicious kernel modules; eBPF programs, by design, run without loading an LKM, and a routine lsmod check can miss them. The kernel’s built‑in verifier accepts eBPF programs that pass its checks, making a malicious program appear indistinguishable from a legitimate one to kernel-level controls. That means defenders must look beyond module loads to determine who loaded an eBPF program and what it actually does.
From BPFDoor and Symbiote to LinkPro — a short, accelerating timeline
Public research and incident reports show an evolution from proof-of-concept to operational malware. PwC and Elastic Security Labs documented BPFDoor — a passive Linux backdoor using a classic BPF socket filter — after PwC discovered the sample in 2021 and public reporting followed in 2022 describing activity targeting organizations in the Middle East and Asia. Around the same time, Intezer and BlackBerry disclosed Symbiote, which uses the dynamic linker to preload a malicious library that intercepts setsockopt() and conceals traffic by modifying attached BPF filters.
Academic and conference work preceded these incidents: researchers presented ebpfkit at Black Hat USA and DEF CON in 2021, and subsequent tools such as TripleCross and Boopkit demonstrated techniques for syscall hooks, XDP and traffic control programs, library injection, execution hijacking, and directory-entry hiding. In October 2025, Synacktiv reported LinkPro — an intrusion that began with an exposed Jenkins server — where eBPF programs were used to hide host activity and trigger a backdoor via a specially crafted packet.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadUnderground adoption: Duty Free, Pastebin, and reposted exploits
Flare’s monitoring of forums, marketplaces, and paste sites turned up ready-to-use code and tutorials shifting offensive eBPF techniques into criminal tradecraft. On the Russian-language Duty Free forum a user published a tutorial citing BPFDoor and Symbiote, including source code and screenshots, and describing packet-triggered activation, getdents64-based process hiding, AES-256-GCM for C2, and an XDP filter that drops packets matching 43 IP addresses the author associated with antivirus vendors.
Researchers also found at least 10 Pastebin posts with XDP packet-processing code and timing thresholds expressed in microseconds. The dataset shows old vulnerabilities reposted widely — the most frequently reposted exploit targeted CVE-2017-16995, a 2017 BPF verifier flaw — alongside newer, unverified proofs-of-concept. One fresh proof-of-concept targets kTLS and eBPF sockmaps to try to corrupt /etc/passwd and inject a UID 0 account; the PoC’s claim of compatibility with all kernels from 4.18 onward is incorrect, because upstream Linux 4.18 lacks a BPF helper the code calls, and successful privilege escalation on Ubuntu 22.04 or 24.04 has not been verified. In one reviewed exploit sample, the author credited Claude in a source-code comment with generating the BPF instructions.
Detection is hard — concrete signals defenders should watch
Because eBPF operates through a legitimate kernel interface, detection strategies that rely only on LKM observation are insufficient. Current defensive measures focus on monitoring bpf() syscalls, tracking loaded programs with bpftool, and watching for suspicious attachments to sensitive syscalls such as getdents64 and execve. These tactics are largely reactive, and Flare warns attackers retain the advantage of working through the kernel’s approved mechanisms.
Flare and incident investigators offer specific defensive steps you can implement today:
- Audit loaded eBPF programs regularly with bpftool prog list and know what’s supposed to be present.
- Restrict eBPF access by setting kernel.unprivileged_bpf_disabled=1 and limiting CAP_BPF and CAP_NET_ADMIN capabilities.
- Monitor for "magic" packets — several eBPF backdoors activate via specific TCP flags or window sizes.
- Patch aggressively: BPF verifier bugs are a recurring vulnerability class that attackers quickly weaponize.
- Watch for unexpected XDP programs attached to network interfaces.
- Compare multiple sources of host telemetry — eBPF implants may hide from bpftool prog list, but associated BPF maps and links can still be visible.
What this means for technologists, defenders, and affected enterprises
Technologists and security teams should treat eBPF as a privileged kernel interface: make bpftool audits and kernel parameter controls standard parts of hardening checklists and incident playbooks. Monitor for unusual packet patterns tied to activation methods described in underground tutorials.
Affected enterprises and procurement leaders must recognize that Linux-based infrastructure can be targeted with emerging tooling that blends legitimate kernel features and covert activation mechanisms; require suppliers and cloud providers to disclose eBPF usage and provide telemetry that surfaces XDP programs and BPF maps.
Adversaries and underground actors now have accessible recipes: with copyable tutorials, paste-site code, and reposted exploits — including a widely reposted CVE-2017-16995 exploit — the technical barrier to entry for weaponizing eBPF has been lowered.
eBPF began as a powerful tool for defenders. Flare’s findings show it has already become a powerful tool for attackers as well — moving from conference demonstrations and academic papers into forum tutorials, paste sites, and operational malware like LinkPro. The practical implication is clear: defenders cannot rely on old checks alone. They must expand visibility, harden kernel settings, and treat eBPF artifacts — maps, links, XDP programs and packet triggers — as first-class telemetry in investigations.
