Wittlich (ots) - Im Zeitraum 23.01.2026 bis 26.01.2026 begaben sich bisher unbekannte Täter zu einem Baustellencontainer einer Baustelle in der Kurfürstenstraße in Wittlich. Hier trennten sie mittels eines Winkelschleifers die Scharniere auf und ...
https://www.presseportal.de/blaulicht/pm/117697/6204488
#Baustelle #Container #Einbruchsdiebstahl #Kurfürstenstraße #Täter











![[ImageSource: Check Point Research]
VoidLink High Level Overview.
👾A cloud-first implant written in the Zig programming language, the toolkit can detect major cloud environments, viz. Amazon Web Services [AWS], Google Cloud, Microsoft Azure, Alibaba and Tencent, and adapt its behavior if it recognizes that it's running within a Docker container or a Kubernetes pod. It can also gather credentials associated with cloud environments and popular source code version control systems such as Git.👾
<https://ziglang.org/>
⁉️The targeting of these services is an indication that VoidLink is likely engineered to target software developers, either with an intent to steal sensitive data or leverage the access to conduct supply chain attacks.⁉️
Some of its other capabilities are listed below:
• Rootkit-like features using LD_PRELOAD, loadable kernel module [LKM], and eBPF to hide its processes based on the Linux kernel version
• An in-memory plugin system for extending functionality
• Support for varied command-and-control [C2] channels, such as HTTP/HTTPS, WebSocket, ICMP and DNS tunneling
• Form a peer-to-peer [P2P] or mesh-style network between compromised hosts
<https://en.wikipedia.org/wiki/Loadable_kernel_module>](https://files.mastodon.social/cache/media_attachments/files/115/927/785/958/861/075/small/7ca5836af537e9da.jpeg)
![[ImageSource: Check Point Research]
Builder Panel to create customized Versions of VoidLink.
A Chinese web-based dashboard that allows the attackers to remotely control the implant, create bespoke versions on the fly, manage files, tasks and plugins, and carry out different stages of the attack cycle right from reconnaissance and persistence to lateral movement and defense evasion by wiping traces of malicious activity.
⁉️VoidLink supports 37 plugins that span anti-forensics, reconnaissance, containers, privilege escalation, lateral movement and other, transforming it into a full-fledged post-exploitation framework:⁉️
• Anti-forensics, to wipe or edit logs and shell history based on keywords and perform timestomping of files to hinder analysis
• Cloud, to facilitate Kubernetes and Docker discovery and privilege-escalation, container escapes, and probes for misconfigurations
• Credential harvesting, to collect credentials and secrets, including SSH keys, git credentials, local password material, browser credentials and cookies, tokens and API keys
• Lateral movement, to spread laterally using an SSH-based worm
• Persistence, to help establish persistence via dynamic linker abuse, cron jobs and system services
• Recon, to gather detailed system and environment information
👾Describing it as "impressive" and "far more advanced than typical Linux malware," Check Point said VoidLink features a core orchestrator component that handles C2 communications and task execution.👾](https://files.mastodon.social/cache/media_attachments/files/115/927/785/995/134/485/small/4fccd8e993730cbf.jpeg)