Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework
Excerpt
Introduction During a recent investigation, we came across a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink , a cloud-native Linux malware framework first documented by Check Point Research in January 2026. Check Point's analysis revealed VoidLink to be a sophisticated, modular command-and-control framework written in Zig, featuring cloud-environment detection, a plugin ecosystem of over 30 modules,…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 116.62.172.147 | High | Score 86/100 | First seen |
| IP | 8.149.128.10 | High | Score 76/100 | First seen |
IOC Relationship Graph
Building graph…