Cybersecuritynews VoidLink Framework Emerges as Modular Malware for Linux and Cloud Systems
Article Content
Browse articles 
The VoidLink framework has been identified as a new modular malware tool targeting Linux systems and cloud environments. Cisco Talos has linked this framework to the threat actor UAT-9921, which is known for compromising internet-facing servers. Key features of VoidLink include on-demand compilation and modular plugins, indicating a shift towards AI-enabled attack platforms.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
Timeline
2026-02-11
VoidLink framework publicly exposed by cybersecurity analysts
2026-02-11
Cisco Talos links VoidLink to threat actor UAT-9921
Recent
VoidLink activity observed in the wild
More articles in this cluster (4)
Following this threat?
Track Alchimist and Cisco in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…