Loading threat actor…
Earth Bluecrow, also known as Red Menshen and EarthBluecrow, is a cyberespionage threat actor associated with the BPFDoor backdoor. First documented as Red Menshen in 2021, the group targets Linux servers in telecommunications, financial services, and retail organizations across Asia, the Middle East, and Africa. Documented targets include organizations in South Korea, Hong Kong, Myanmar, Malaysia, and Egypt. The group's operations emphasize long-term covert access and lateral movement within compromised networks. BPFDoor uses classic Berkeley Packet Filter functionality to recognize activation packets without maintaining a conventional listening port before activation. It supports TCP, UDP, and ICMP activation, reverse shells, direct shell access through temporary firewall redirection, and backdoor-liveness checks. Its stealth techniques include process-name masquerading, suppression of shell-command history, and removal of temporary firewall rules after connections are established. Operators have controlled multiple compromised servers within victim networks and uploaded additional tools. The initial-access mechanisms for the investigated compromises remain unknown.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families Mallory has associated with this actor across public reporting.
46 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.