VoidLink: a new malware framework aimed at cloud and Linux

Researchers at Check Point have discovered a new command-and-control framework they have named VoidLink. The framework targets cloud and Linux environments and appears both sophisticated and feature rich, with capabilities pointing towards stealth and long-term compromise. It has not been observed in the wild but seems to be under active development. The language used in the interface and indicators from the development environment suggest Chinese-affiliated developers, according to the researchers.

What this means for your organisation

Linux and cloud workloads have long had weaker monitoring than Windows endpoints in many organisations, even though the most valuable data often sits there. A framework built specifically for these environments with an emphasis on remaining undetected is a clear signal of where attackers are investing. This is time to prepare, not time to handle an incident.

Berigo recommends

• Verify that Linux servers and containers have the same logging and detection maturity as your endpoint estate.
• Ensure cloud logs are centrally collected and actually acted upon.
• Review which outbound connections workloads are permitted to establish.
• Add Linux and cloud compromise as a dedicated scenario in incident exercises.

Source

• research.checkpoint.com