https://sudonull.com/ebpf-rootkit-in-linux-db-leak-via-contractor
Breakdown of a real eBPF rootkit case: symptoms, detection with bpftool, attack chain via contractor. Protection measures for Linux servers: 2FA, bpf() audit, Falco. Learn how to prevent PII exfiltration.