Look up "eBPF rootkits"

This is a good article about one found in the wild: https://www.synacktiv.com/en/publications/linkpro-ebpf-rootk...