Hackers are weaponizing Linux's favorite tool against it

The same powerful eBPF technology that developers love for monitoring and security in the Linux kernel is now being weaponized by cybercriminals. eBPF allows programs to run inside the kernel without loading traditional modules, making it a powerful tool for both defenders and attackers.

Underground forums are now hosting tutorials and code for eBPF rootkits that can hide processes, monitor system calls, and modify network traffic while evading standard detection methods. These attacks bypass traditional kernel module checks and leverage the same legitimate interfaces that tools like Cilium use. The threat has moved from theoretical conference talks to active discussions in criminal forums, meaning defenders need to update their detection strategies now that attackers have discovered this powerful new toolkit.