--- title: Sophisticated VoidLink malware framework targets Linux... description: Check Point researchers discovered VoidLink, a sophisticated modular malware framework written in Zig that targets Linux cloud servers. The malware detects... canonical: https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sophisticated VoidLink malware framework targets Linux cloud servers | daily.dev og:description: Check Point researchers discovered VoidLink, a sophisticated modular malware framework written in Zig that targets Linux cloud servers. The malware detects... og:url: https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9 og:image: https://api.daily.dev/og/posts/TaWMZZCV9.png og:image:alt: Sophisticated VoidLink malware framework targets Linux cloud servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sophisticated VoidLink malware framework targets Linux cloud servers **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Check Point researchers discovered VoidLink, a sophisticated modular malware framework written in Zig that targets Linux cloud servers. The malware detects major cloud platforms (AWS, GCP, Azure, Alibaba, Tencent) and containerized environments (Docker, Kubernetes), adapting its behavior accordingly. It features 37 default plug-ins, a professional Chinese-localized C2 dashboard, and advanced evasion techniques including rootkit components, EDR detection, and encrypted C2 traffic hidden in image and web files. The framework calculates environment risk scores to select optimal stealth strategies, harvests cloud credentials and source code repository access, and appears designed for long-term surveillance and data collection in cloud environments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Never-before-seen Linux malware is “far more advanced than typical”](https://daily.dev/posts/never-before-seen-linux-malware-is-far-more-advanced-than-typical--x9wl564rc) · Ars Technica · 0 upvotes · 0 comments - [Deconstructing Voidlink: Why New AI and Cloud-Native Threats Require a New Class of Defense](https://daily.dev/posts/deconstructing-voidlink-why-new-ai-and-cloud-native-threats-require-a-new-class-of-defense-1jhvz4xgq) · Isovalent · 1 upvotes · 0 comments - [A Retrospective on Workload Security](https://daily.dev/posts/a-retrospective-on-workload-security-iuyxmwanw) · Cisco · 0 upvotes · 0 comments - [VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun](https://daily.dev/posts/voidlink-evidence-that-the-era-of-advanced-ai-generated-malware-has-begun-nltc7gtyu) · Check Point Research · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#linux](https://daily.dev/tags/linux), [#kubernetes](https://daily.dev/tags/kubernetes), [#docker](https://daily.dev/tags/docker) [View this post on daily.dev](https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sophisticated VoidLink malware framework targets Linux cloud servers","url":"https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9"},"datePublished":"2026-01-15T00:23:23.504Z","dateModified":"2026-01-15T00:23:41.855Z","description":"Check Point researchers discovered VoidLink, a sophisticated modular malware framework written in Zig that targets Linux cloud servers. The malware detects...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f3c8712665c14d747daec32bd868a2ba?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f3c8712665c14d747daec32bd868a2ba?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sophisticated-voidlink-malware-framework-targets-linux-cloud-servers-tawmzzcv9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,linux,kubernetes,docker","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Sophisticated VoidLink malware framework targets Linux cloud servers"}]} ```