← Back to feed
AwarenessEmerging1 sourceJul 27, 2026 · 00:00via Datadog Security Labs

Detection primitives for eBPF rootkits

Brief

We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.

Read more on Datadog Security Labs