Cybersecuritynews

VoidLink Framework Emerges as Modular Malware for Linux and Cloud Systems

First seen 12 Feb 2026, 12:40 UTC • Blog.Talosintelligence

•85% similarity •20.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The VoidLink framework has been identified as a new modular malware tool targeting Linux systems and cloud environments. Cisco Talos has linked this framework to the threat actor UAT-9921, which is known for compromising internet-facing servers. Key features of VoidLink include on-demand compilation and modular plugins, indicating a shift towards AI-enabled attack platforms.

ThreatCluster AI How this analysis works

Timeline

2026-02-11

VoidLink framework publicly exposed by cybersecurity analysts

2026-02-11

Cisco Talos links VoidLink to threat actor UAT-9921

Recent

VoidLink activity observed in the wild

Attack Flow

22 entities, 38 inferred relationships (STIX 2.1).

Technique (7)

Malware
T1041 - Exfiltration Over C2 Channel
T1071 - Application Layer Protocol
T1078 - Valid Accounts
T1203 - Exploitation for Client Execution
T1574.001 - DLL
T1574 - Hijack Execution Flow

Organization (1)

Cisco

Malware (6)

Alchimist
Cobalt Strike
Insekt
Manjusaka
Sliver
VoidLink

Affected Platform (5)

Apache Dubbo
Kubernetes
Linux
MacOS
Windows

Tool (3)

Supershell
Docker
Fscan

Relationships

Alchimist targets Cisco
Cobalt Strike targets Cisco
Insekt targets Cisco
Manjusaka targets Cisco
Sliver targets Cisco
VoidLink targets Cisco
Malware targets Apache Dubbo
Malware targets Kubernetes
Malware targets Linux
Malware targets MacOS
T1041 - Exfiltration Over C2 Channel targets Apache Dubbo
T1041 - Exfiltration Over C2 Channel targets Kubernetes
T1041 - Exfiltration Over C2 Channel targets Linux
T1041 - Exfiltration Over C2 Channel targets MacOS
T1071 - Application Layer Protocol targets Apache Dubbo
T1071 - Application Layer Protocol targets Kubernetes
T1071 - Application Layer Protocol targets Linux
T1071 - Application Layer Protocol targets MacOS
T1078 - Valid Accounts targets Apache Dubbo
T1078 - Valid Accounts targets Kubernetes
T1078 - Valid Accounts targets Linux
T1078 - Valid Accounts targets MacOS
T1203 - Exploitation for Client Execution targets Apache Dubbo
T1203 - Exploitation for Client Execution targets Kubernetes
T1203 - Exploitation for Client Execution targets Linux
T1203 - Exploitation for Client Execution targets MacOS
T1574.001 - DLL targets Apache Dubbo
T1574.001 - DLL targets Kubernetes
T1574.001 - DLL targets Linux
T1574.001 - DLL targets MacOS
T1574 - Hijack Execution Flow targets Apache Dubbo
T1574 - Hijack Execution Flow targets Kubernetes
T1574 - Hijack Execution Flow targets Linux
T1574 - Hijack Execution Flow targets MacOS
Alchimist related to Windows
Alchimist related to Supershell
Alchimist related to Docker
Alchimist related to Fscan

Community

Browse all →

Tracked Entities in This Story

Alchimist Cobalt Strike Insekt Manjusaka Sliver VoidLink Cisco Apache Dubbo Kubernetes Linux MacOS Windows Financial Technology

VoidLink Framework Emerges as Modular Malware for Linux and Cloud Systems

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story