--- analysis: A simple rule for Dubbo exploitation or rootkit loading would generate excessive noise in large Linux environments. This hunt uses a gated logic to only perform forensic analysis on hosts with the target software, applies prevalence baseline counting to filter common maintenance scripts, and uses an agent to weigh multiple independent indicators before recommending isolation. blind_spots: - id: no-inventory-telemetry question: whether Apache Dubbo is present on servers that do not report inventory requires: hb_software_inventory for all Linux servers risk: A host without inventory reporting might be a target but will cause the lead query to return silence, skipping forensic analysis. stage: initial-access-dubbo-exploit - id: ebpf-rootkit-stealth question: whether an eBPF rootkit is active without a traditional LKM load requires: eBPF probe registration telemetry risk: VoidLink supports eBPF rootkits which may not appear as a module file on disk or a traditional .ko load event in hb_module_activity. stage: rootkit-and-privilege-escalation - id: no-agent-coverage question: whether VoidLink activity occurs on unmanaged or shadow IT systems requires: Endpoint agent on high-value servers risk: The behavioural queries only cover systems where telemetry is collected; unmanaged servers exploited via Dubbo remain invisible. coverage: - stage: initial-access-dubbo-exploit status: covered steps: - lead-dubbo-inventory - suspicious-java-children - stage: implant-execution-and-sideloading status: covered steps: - suspicious-java-children - stage: rootkit-and-privilege-escalation status: covered steps: - unsigned-kernel-modules - reason: Belongs to another part of the 'VoidLink' series. stage: internal-scanning-recon status: out_of_scope - reason: Belongs to another part of the 'VoidLink' series. stage: cloud-api-discovery status: out_of_scope - reason: Belongs to another part of the 'VoidLink' series. stage: mesh-c2-communications status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: VoidLink is a sophisticated, defense-contractor grade framework targeting Linux environments. Identifying its deployment through initial exploit patterns and kernel persistence is essential for protecting server infrastructure from persistent compromise. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited a Java-based Apache Dubbo service to deploy a ZigLang-based VoidLink implant and maintained stealth using an unsigned kernel-level rootkit. labels: - hunt - attack.t1190 - attack.t1204.002 - attack.t1574.002 name: 'VoidLink: Exploitation and Kernel-Level Implant Deployment' parameters: lookback_days: default: '14' description: Days of history to examine for process and module activity. from: kind: manual observed: '2024-01-01' ref: VoidLink analysis lookback type: number rare_threshold: default: '5' description: The maximum number of hosts a process path can appear on to be considered rare. type: number scope_hosts: default: [] description: List of hostnames from the software inventory lead to focus behavioral queries. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.talosintelligence.com/voidlink/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on Linux servers running Java middleware, particularly those with internet exposure. The hunt starts with a wide software scan and then uses specific behavioural triggers to narrow the volume. references: - name: "Cisco Talos \u2014 VoidLink" url: https://blog.talosintelligence.com/voidlink/ related: - hunt: voidlink-internal-recon-and-lateral-movement reason: This hunt focuses on initial deployment; a follow-on hunt is needed for internal scanning using FSCAN and mesh-C2 traffic. relation: follows scenario: stages: - name: Apache Dubbo Java Serialization Exploitation observables: - Apache Dubbo project - Java serialization vulnerabilities - Pre-obtained credentials slug: initial-access-dubbo-exploit tactic: initial-access techniques: - T1190 - name: VoidLink Implant Execution observables: - ZigLang-based implant binary - DLL sideloading on Windows - C-based plugins loaded via ELF linker - VoidLink compile-on-demand framework slug: implant-execution-and-sideloading tactic: execution techniques: - T1204.002 - T1574.002 - name: Persistence and Privilege Escalation observables: - eBPF rootkit - Loadable Kernel Module (LKM) rootkit - Container privilege escalation - Docker/Kubernetes sandbox escape slug: rootkit-and-privilege-escalation tactic: persistence techniques: - T1574.002 - name: Internal Network Reconnaissance observables: - FSCAN - SOCKS server on compromised hosts - Scanning of entire Class C networks - Internal and external network scanning slug: internal-scanning-recon tactic: discovery techniques: - T1090.003 - name: Cloud and Container Asset Discovery observables: - Kubernetes API interactions - Docker API interactions - Cloud-aware gathering of environment info slug: cloud-api-discovery tactic: discovery - name: Peer-to-Peer Mesh C2 observables: - GoLang backend - Mesh Peer-to-Peer (P2P) routing - Dead-letter queue routing - Encrypted/obfuscated exfiltration traffic slug: mesh-c2-communications tactic: command-and-control techniques: - T1071 - T1090.003 - T1041 summary: UAT-9921 utilizes the VoidLink modular framework, targeting Linux and Windows systems by exploiting Java serialization vulnerabilities in Apache Dubbo or using stolen credentials. The ZigLang-based implant deploys plugins for eBPF-based rootkits and container escapes, while conducting internal reconnaissance with FSCAN and establishing a peer-to-peer mesh command-and-control network. series: index: 1 slug: voidlink title: VoidLink total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # VoidLink: Exploitation and Kernel-Level Implant Deployment This hunt targets the initial stages of a VoidLink intrusion. It identifies servers running Apache Dubbo, which is a reported entry point for UAT-9921. If the software is present, the hunt triggers a gated forensic fan-out to find suspicious child processes spawning from Java and unsigned kernel modules that indicate rootkit activity. An agent then synthesizes the inventory context with the behavioural findings to identify compromised hosts. ## lead-dubbo-inventory Identify the subset of the fleet running Apache Dubbo, which UAT-9921 targets for remote code execution. ```sqlite target=endpoint role=scoping ~~~yaml expected: Hosts running Dubbo. If none are found, the likelihood of this specific exploit chain is low, though manual deployments may still exist. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%dubbo%' ``` ## evaluate-scoping ```agent target=hunter cite: required context: - lead-dubbo-inventory max_iterations: 3 objective: Confirm the presence of Apache Dubbo and identify target servers for forensic analysis. success_criteria: A list of hostnames to populate the scope_hosts parameter. tools: - endpoint ``` ## gate-to-forensics if: `evaluate-scoping.rows > 0` then: → forensic-fan-out else: → close-out ## forensic-fan-out parallel: - → suspicious-java-children - → unsigned-kernel-modules join: → triage-synthesis ## suspicious-java-children Detect the transition from Java serialization exploitation to execution of an implant, focusing on rare binaries in temporary directories. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, rare_threshold=rare_threshold) ~~~yaml baseline: compare: new_this_window window: '{{lookback_days}}d' expected: Rare binaries spawned by Java in world-writable paths. A small host count indicates a targeted deployment rather than legitimate maintenance. prevalence: by: device_hostname key: - process_path rare_below: 5 reads: - device_hostname - process_path - parent_process_name - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT LOWER(process_path) AS binary_path, parent_process_name, COUNT(DISTINCT device_hostname) AS host_count FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%java%' AND (LOWER(process_path) LIKE '%/tmp/%' OR LOWER(process_path) LIKE '%/dev/shm/%' OR LOWER(process_path) LIKE '%/var/tmp/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2 HAVING host_count <= {{rare_threshold}} ``` ## unsigned-kernel-modules Identify potential LKM rootkits deployed by VoidLink to hide its presence and the C2 server. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Unsigned modules loaded from temporary or hidden paths. Legitimate kernel modules are typically signed and live in /lib/modules/. prevalence: by: device_hostname key: - module_name rare_below: 3 reads: - device_hostname - module_path - module_name - module_signed - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, module_path, module_name, module_signed, time FROM hb_module_activity WHERE module_signed = 0 AND (LOWER(module_path) LIKE '%/tmp/%' OR LOWER(module_path) LIKE '%/.%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-synthesis ```agent target=hunter cite: required context: - evaluate-scoping - suspicious-java-children - unsigned-kernel-modules max_iterations: 6 objective: Determine if any host showing Dubbo software also exhibits rare Java child processes or suspicious kernel modules. success_criteria: A per-host verdict of malicious | suspicious | benign, citing specific binary paths and module names. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host running Dubbo" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-agent-coverage) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Preserve any artifacts in temporary directories and perform a memory dump to capture the rootkit state. ``` → analyst-review ## analyst-review ```manual target=analyst Review the cited child processes and unsigned modules. Confirm if the rare binaries use ZigLang or C as reported. Investigate the command line of the Java parent to identify the serialization exploit attempt. ``` → end ## close-out ```manual target=analyst Record the hosts scanned and the absence of matching behaviour. If many false positives occurred from legitimate Java child processes, update the rare_threshold or add exclusions for known maintenance scripts. ``` → end