{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "VoidLink is a defense contractor grade framework with advanced mesh and cloud-aware capabilities. Its ability to create stealthy internal peer networks to bypass boundary controls makes a negative result critical for the security of infrastructure services and supply chain integrity." }, "name": "VoidLink Lateral Scanning and Mesh C2", "type": "investigation", "labels": [ "hunt", "attack.t1041", "attack.t1071", "attack.t1090.003", "attack.t1190" ], "series": { "slug": "voidlink", "index": 2, "title": "VoidLink", "total": 2 }, "related": [ { "hunt": "voidlink-implant-execution-and-rootkits", "reason": "This hunt focuses on network reconnaissance and mesh P2P; local persistence and rootkit behavior are handled in a sibling hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "voidlink-exploitation-and-kernel-deployment", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard rule might detect the name 'fscan'. This hunt identifies a coordinated VoidLink intrusion by correlating that process lead with targeted container API discovery and a statistical baseline of rare internal P2P traffic that a single rule cannot contextualize.", "coverage": [ { "stage": "internal-scanning-recon", "steps": [ "find-scanners-and-proxies", "mesh-peer-connections" ], "status": "covered" }, { "stage": "cloud-api-discovery", "steps": [ "container-api-recon" ], "status": "covered" }, { "stage": "mesh-c2-communications", "steps": [ "mesh-peer-connections", "triage-voidlink" ], "status": "covered" }, { "stage": "initial-access-dubbo-exploit", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" }, { "stage": "implant-execution-and-sideloading", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" }, { "stage": "rootkit-and-privilege-escalation", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Apache Dubbo Java Serialization Exploitation", "slug": "initial-access-dubbo-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Apache Dubbo project", "Java serialization vulnerabilities", "Pre-obtained credentials" ] }, { "name": "VoidLink Implant Execution", "slug": "implant-execution-and-sideloading", "tactic": "execution", "techniques": [ "T1204.002", "T1574.002" ], "observables": [ "ZigLang-based implant binary", "DLL sideloading on Windows", "C-based plugins loaded via ELF linker", "VoidLink compile-on-demand framework" ] }, { "name": "Persistence and Privilege Escalation", "slug": "rootkit-and-privilege-escalation", "tactic": "persistence", "techniques": [ "T1574.002" ], "observables": [ "eBPF rootkit", "Loadable Kernel Module (LKM) rootkit", "Container privilege escalation", "Docker/Kubernetes sandbox escape" ] }, { "name": "Internal Network Reconnaissance", "slug": "internal-scanning-recon", "tactic": "discovery", "techniques": [ "T1090.003" ], "observables": [ "FSCAN", "SOCKS server on compromised hosts", "Scanning of entire Class C networks", "Internal and external network scanning" ] }, { "name": "Cloud and Container Asset Discovery", "slug": "cloud-api-discovery", "tactic": "discovery", "observables": [ "Kubernetes API interactions", "Docker API interactions", "Cloud-aware gathering of environment info" ] }, { "name": "Peer-to-Peer Mesh C2", "slug": "mesh-c2-communications", "tactic": "command-and-control", "techniques": [ "T1071", "T1090.003", "T1041" ], "observables": [ "GoLang backend", "Mesh Peer-to-Peer (P2P) routing", "Dead-letter queue routing", "Encrypted/obfuscated exfiltration traffic" ] } ], "summary": "UAT-9921 utilizes the VoidLink modular framework, targeting Linux and Windows systems by exploiting Java serialization vulnerabilities in Apache Dubbo or using stolen credentials. The ZigLang-based implant deploys plugins for eBPF-based rootkits and container escapes, while conducting internal reconnaissance with FSCAN and establishing a peer-to-peer mesh command-and-control network." }, "severity": "high", "rationale": "Focus the search on Linux servers, specifically those in network segments hosting containerized applications or management infrastructure. Widen the scope to any host showing connections to Docker/Kubernetes management ports from non-admin networks.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is using a VoidLink implant to perform automated internal reconnaissance and establish a peer-to-peer mesh command-and-control network between compromised Linux servers.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Restrict investigation to these hosts identified in the scoping query; leave empty for fleet-wide." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "scanner_keywords": { "from": { "ref": "https://blog.talosintelligence.com/voidlink/", "kind": "article", "observed": "2025-01-20" }, "type": "list[string]", "default": [ "fscan", "gscan", "socks5", "proxy" ], "description": "Common lateral movement tool names found in VoidLink campaigns." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/voidlink/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/voidlink/", "name": "Cisco Talos \u2014 VoidLink: A Giant Leap in Attack Framework Evolution" } ], "blind_spots": [ { "id": "process-hiding-rootkit", "risk": "The find-scanners-and-proxies lead query may return zero results if the rootkit successfully hooks the kernel, leaving network connections as the only detectable signal.", "stage": "internal-scanning-recon", "question": "whether the implant is using its rootkit capability to hide the scanner processes", "requires": "Endpoint telemetry uncompromised by LKM/eBPF rootkits" }, { "id": "encrypted-p2p-payload", "risk": "Without deep packet inspection, the hunt relies on statistical rarity and the association with scanner tools to infer maliciousness.", "stage": "mesh-c2-communications", "question": "whether the traffic on high ports is legitimate service traffic or VoidLink mesh C2", "requires": "Network flow telemetry with payload inspection" } ] }, "name": "VoidLink Lateral Scanning and Mesh C2", "description": "VoidLink is an AI-aided modular framework used by UAT-9921 for stealthy reconnaissance and resilient C2 routing. This hunt focuses on identifying the indicators of a VoidLink intrusion by detecting the execution of lateral movement tools like FSCAN, identifying attempts to discover Kubernetes or Docker management endpoints, and baselining rare internal peer-to-peer network connections that signify the framework's unique mesh routing capability. The hunt starts with a lead based on process execution and then fans out to examine network telemetry for cloud-specific discovery and statistical outliers in internal traffic." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "voidlink", "index": 2, "title": "VoidLink", "total": 2 }, "coverage": [ { "stage": "internal-scanning-recon", "steps": [ "find-scanners-and-proxies", "mesh-peer-connections" ], "status": "covered" }, { "stage": "cloud-api-discovery", "steps": [ "container-api-recon" ], "status": "covered" }, { "stage": "mesh-c2-communications", "steps": [ "mesh-peer-connections", "triage-voidlink" ], "status": "covered" }, { "stage": "initial-access-dubbo-exploit", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" }, { "stage": "implant-execution-and-sideloading", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" }, { "stage": "rootkit-and-privilege-escalation", "reason": "Belongs to another part of the 'VoidLink' series.", "status": "out_of_scope" } ], "rationale": "An intruder is using a VoidLink implant to perform automated internal reconnaissance and establish a peer-to-peer mesh command-and-control network between compromised Linux servers.", "blind_spots": [ { "id": "process-hiding-rootkit", "risk": "The find-scanners-and-proxies lead query may return zero results if the rootkit successfully hooks the kernel, leaving network connections as the only detectable signal.", "stage": "internal-scanning-recon", "question": "whether the implant is using its rootkit capability to hide the scanner processes", "requires": "Endpoint telemetry uncompromised by LKM/eBPF rootkits" }, { "id": "encrypted-p2p-payload", "risk": "Without deep packet inspection, the hunt relies on statistical rarity and the association with scanner tools to infer maliciousness.", "stage": "mesh-c2-communications", "question": "whether the traffic on high ports is legitimate service traffic or VoidLink mesh C2", "requires": "Network flow telemetry with payload inspection" } ], "scoping_notes": "Focus the search on Linux servers, specifically those in network segments hosting containerized applications or management infrastructure. Widen the scope to any host showing connections to Docker/Kubernetes management ports from non-admin networks.", "beyond_detection": "A standard rule might detect the name 'fscan'. This hunt identifies a coordinated VoidLink intrusion by correlating that process lead with targeted container API discovery and a statistical baseline of rare internal P2P traffic that a single rule cannot contextualize." } }, { "id": "find-scanners-and-proxies", "type": "query", "label": "Lead: Lateral movement tools and proxies", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{scanner_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%fscan%' OR LOWER(process_cmd_line) LIKE '%gscan%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify potential beachhead hosts where the adversary has executed reconnaissance tools or SOCKS proxies as reported in VoidLink campaigns.", "expected_signal": "Rows identify hosts running known lateral movement tools. Silence means no known scanner names were used, not that scanning is absent." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Lead: Lateral movement tools and proxies", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{scanner_keywords}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%fscan%' OR LOWER(process_cmd_line) LIKE '%gscan%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Rows identify hosts running known lateral movement tools. Silence means no known scanner names were used, not that scanning is absent.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "container-api-recon", "type": "query", "label": "Targeted discovery of container APIs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as events FROM hb_network_connection WHERE (dst_endpoint_port IN (2375, 2376, 6443)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port", "surface": "hb_network_connection", "description": "Identify network attempts to access Kubernetes or Docker management endpoints, reflecting VoidLink's cloud-aware reconnaissance.", "expected_signal": "Connections from Linux servers to Docker or Kubernetes management ports. Silence confirms no discovery of these specific services occurred from the scoped hosts." }, "parents": [ { "id": "find-scanners-and-proxies" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Targeted discovery of container APIs", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as events FROM hb_network_connection WHERE (dst_endpoint_port IN (2375, 2376, 6443)) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port", "silence": "evidence_of_absence", "expected": "Connections from Linux servers to Docker or Kubernetes management ports. Silence confirms no discovery of these specific services occurred from the scoped hosts.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "mesh-peer-connections", "type": "query", "label": "Baseline internal peer-to-peer traffic", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.%') AND src_endpoint_port > 1024 AND dst_endpoint_port > 1024 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING connection_count <= 20 ORDER BY connection_count ASC", "surface": "hb_network_connection", "description": "Find the rare internal network connections between high-numbered ports that indicate a VoidLink mesh network bypassing boundary controls.", "expected_signal": "A few rare connections between internal servers that are not part of known server-to-server patterns (e.g., DB or logging)." }, "parents": [ { "id": "find-scanners-and-proxies" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Baseline internal peer-to-peer traffic", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "direction", "src_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND (dst_endpoint_ip LIKE '10.%' OR dst_endpoint_ip LIKE '192.168.%' OR dst_endpoint_ip LIKE '172.%') AND src_endpoint_port > 1024 AND dst_endpoint_port > 1024 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING connection_count <= 20 ORDER BY connection_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A few rare connections between internal servers that are not part of known server-to-server patterns (e.g., DB or logging).", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "triage-voidlink", "type": "analytic", "label": "Triage VoidLink activity", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "find-scanners-and-proxies", "container-api-recon", "mesh-peer-connections" ], "objective": "Determine if any host shows the combination of automated scanning tools and rare internal P2P or cloud-discovery network behavior consistent with VoidLink.", "description": "Correlate the process-based leads with the network-based discovery and mesh evidence to confirm a VoidLink intrusion.", "max_iterations": 4, "expected_signal": "A per-host verdict citing the combination of tool execution and anomalous internal network discovery.", "success_criteria": "A verdict of malicious for hosts exhibiting process scanner use followed by unauthorized container discovery or P2P mesh traffic." }, "parents": [ { "id": "container-api-recon", "kind": "merge" }, { "id": "mesh-peer-connections", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on VoidLink verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "process-hiding-rootkit", "confidence": "high", "description": "Contain the host if malicious scanning and C2 behavior is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-voidlink" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate the compromised host", "config": { "target": "endpoint", "description": "Stop the adversary's automated lateral scanning and mesh routing by isolating the host from the network.", "instructions": "Isolate the host from the internal network immediately. Preserve the memory and the ZigLang implant for reverse engineering before wiping the system.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "forensic-mesh-mapping", "type": "task", "label": "Forensic mesh topology mapping", "config": { "assignee": "analyst", "description": "Examine the peer IPs from the mesh connection results to identify other nodes in the VoidLink network.", "instructions": "Review the internal destination IPs from the mesh-peer-connections query. Cross-reference these IPs with the scoping query to check for similar tool execution on those hosts. Map the internal P2P connections to understand the extent of the lateral movement." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-and-tune", "type": "task", "label": "Close out and tune", "config": { "assignee": "analyst", "description": "Document findings and update tool keywords to reduce false positives from legitimate administrative activity.", "instructions": "Record the discovered mesh nodes. If authorized internal scanning was found, add those hosts to the tuning notes for future runs. Document any Kubernetes or Docker configuration weaknesses exploited during discovery." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" }, { "id": "forensic-mesh-mapping" } ] } ] }