It lets developers run sandboxed programs inside the kernel without writing kernel modules, while powering everything from network monitoring to security tooling. Linux is extremely popular in production servers and giants like Google, Cloudflare, and Meta rely on it daily.
The same eBPF capabilities that are attractive for defenders, though, can be a powerful weapon in the hands of attackers. Flare's research found underground forum posts sharing eBPF rootkit code and step-by-step tutorials.
One Russian-language post described how to build an implant with process hiding and packet-triggered activation, and included screenshots the author presented as demonstrations. Traditional Linux rootkits typically rely on loadable kernel modules (LKMs) to hook system calls and hide malicious activity.
These are well-understood by defenders, and most EDR solutions watch for suspicious module loads. eBPF, though, behaves in a different way. An eBPF malware can hook into kernel functions, observe system calls, or inspect and modify network traffic using the same kernel-supported bpf() interface as legitimate tools like Cilium. Its programs run without loading a kernel module, so a routine lsmod check can miss them.
