Intezer released an article about Symbiote, a nearly undetectable Linux malware. The analysis is based on the vendor provided tool Intezer Analyze. Technically, the malware is using LD_PRELOAD T1574.006 and relies on BPF byte code.
BPF bytecode is injected into the kernel that defines which packets should be captured. In this process, Symbiote adds its bytecode first so it can filter out network traffic that it doesn’t want the packet-capturing software to see.
One similar malware sample is BPFdoor (VirusTotal). Since live forensics on an infected host may show nothing at all, The Register passes on the researchers’ advice to watch network telemetry for anomalous DNS requests and to statically link AV and EDR software, so Symbiote’s hooks cannot hide anything from them.