Loading malware…
BPFDoor is a stealthy backdoor primarily targeting Linux servers and network appliances to maintain long-term access to compromised environments. It is associated with the China-linked threat actor Red Menshen, also known as Earth Bluecrow and DecisiveArchitect. Observed targets include telecommunications, government, education, logistics, financial services, and retail organizations, particularly across Asia and the Middle East, with additional activity documented in Africa and the United States.
BPFDoor attaches classic Berkeley Packet Filter filters to raw sockets and passively inspects incoming traffic for specially crafted activation packets. This allows it to remain dormant without continuous beaconing or a conventional listening port before activation. Variants recognize triggers carried over TCP, UDP, or ICMP, and some inspect packets before host firewall filtering. After authentication, the implant can establish reverse shells or bind shells, execute commands, and transfer files. Some versions temporarily manipulate firewall redirection rules to route attacker connections from legitimate service ports to a concealed shell, then remove those rules after connection establishment. Newer activation mechanisms tunnel triggers through HTTPS POST requests and edge-proxy SSL offloading.
Its evasion techniques include process-name masquerading, execution from memory-backed storage, deletion of running executables, timestamp manipulation, string obfuscation, encrypted communications, and shell-history suppression. Regional variants impersonate SpamSniper anti-spam components or processes associated with Oracle-backed telecommunications platforms. Startup-script modifications have been used for persistence. Operators deploy controllers on compromised systems to activate implants elsewhere in a victim network, supporting lateral movement. Some variants incorporate TinyShell functionality for interactive access and file transfer. BPFDoor source code leaked in 2022, so the presence of the family alone does not establish attribution to a particular actor.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
52 distinct techniques documented for this family, organized by ATT&CK tactic.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
Based on the password or existence of a password sent in the “magic packet” the backdoor provides a reverse shell, establishes a bind shell, or sends back a ping.
in March 2024, a hacker infiltrated the network by exploiting a vulnerability on the KT Roaming Rental Service website
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
The newer variant analyzed by Deep Instinct features static library encryption, reverse shell communication, and all commands are sent by the C2 server.
912 Open an interactive shell session — up to ten concurrently.
The malware creates a raw network socket and sets BPF filters on it to inspect incoming traffic.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts... The initial report referenced above indicates that persistence scripts have been found.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
Based on the password or existence of a password sent in the “magic packet” the backdoor provides a reverse shell, establishes a bind shell, or sends back a ping.
BPFDoor and Rekoobe samples wait for a magic packet before opening interactive access.
If a packet is observed that matches the BPF filters and contains the required data it is passed to the backdoor for processing... [it] looks for a so-called magic packet.
The BPFDoor variants create a raw PF_PACKET socket, attaching a classic BPF filter.
It allows a threat actor to backdoor a system for remote code execution, without opening any new network ports or firewall rules.
When an adversary implants a persistent backdoor at the kernel level within these environments, they are not simply compromising a server, they are positioning themselves adjacent to subscriber data, signaling flows, and the mechanisms that authenticate and route national and international communications.
The campaign is characterized by the use of kernel-level implants, passive backdoors, credential-harvesting utilities, and cross-platform command frameworks, giving the threat actor the ability to persistently inhabit networks of interest.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts... The initial report referenced above indicates that persistence scripts have been found.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
The campaign is characterized by the use of kernel-level implants, passive backdoors, credential-harvesting utilities, and cross-platform command frameworks, giving the threat actor the ability to persistently inhabit networks of interest.
The following MITRE ATT&CK... sub-techniques have been observed with the BPFDoor malware... Abuse Elevation Control Mechanism: Setuid and Setgid.
Description Generated datasets for Linux Evidence of BPFdoor implant - creation of known lockfiles in attack range.
Strings are hidden with a rotating substitution alphabet.
Renames its process to kdmtmpflush... [then] removes the old one setting (spoofing) a new process name.
The common thread is regionalized disguise: each sample is aware of the vendor’s software running on the targeted systems and implements process spoofing accordingly.
The SpamSniper /var/run/spamsniper.pid mutex, together with the sample provenance, ties this build to the South Korean cluster.
“BPFDoor forks itself… The parent process terminates leaving the forked process to be inherited by the legitimate process init.”
“BPFDoor overwrites the argv[0] value… selects a name… resemble Linux system daemons…”
“Environment variables MYSQL_HISTFILE=/dev/null and HISTFILE=/dev/null are set to suppress shell command logging.”
VIMINIT="set viminfo=", HISTFILE=/dev/null, HISTSIZE=0, and HISTFILESIZE=0.
Deletes itself by removing the original binary invoked. The forked process continues to run.
T1070.006 Timestomp BPFDoor
Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.
That key seeds RC4's key-scheduling algorithm, and the resulting S-box is used directly as a keystream.
BPFDoor and Rekoobe samples wait for a magic packet before opening interactive access.
If a packet is observed that matches the BPF filters and contains the required data it is passed to the backdoor for processing... [it] looks for a so-called magic packet.
The BPFDoor variants create a raw PF_PACKET socket, attaching a classic BPF filter.
another execve syscall was invoked, passing the arguments /bin/rm -f /dev/shm/kdmtmpflush to /bin/sh ... execve("/bin/cp", ["/bin/cp", "./BPFDoor", "/dev/shm/kdmtmpflush"] ... ) ... execve("/bin/chmod", ["/bin/chmod", "755", "/dev/shm/kdmtmpflush"]
The install branch fires only when /tmp/flag already exists on the filesystem and the .php script does not.
“BPFDoor attempts to create and lock a runtime file, /var/run/initd.lock, and exits if it fails… resulting in a makeshift mutex.”
When an adversary implants a persistent backdoor at the kernel level within these environments, they are not simply compromising a server, they are positioning themselves adjacent to subscriber data, signaling flows, and the mechanisms that authenticate and route national and international communications.
BPFDoor... takes great care to be as efficient and stealthy as possible... [and] creates a PID file in /var/run, another temporary file storage facility.
The attacker took special attention to make the lock’s filename appears legitimate, and used several of these filenames across the samples.
“BPFDoor set's it's process to ignore… SIGHUP, SIGINT, SIGQUIT, SIGPIPE, SIGCHLD, SIGTTIN, and SIGTTOU.”
BPFDoor is equipped with stealthy defense evasion techniques.
The same switch-case and iptables NAT-redirect staging/teardown logic found byte-for-byte in a second sample.
“BPFDoor sets the MYSQL_HISTFILE and HISTFILE to /dev/null preventing the shell and MySQL from logging history…”
Next, the malware allocates a memory buffer and creates a packet sniffing socket that it'll use for monitoring incoming traffic for a "magic" byte sequence.
We found custom sniffers, custom tooling to intercept usernames and passwords — very highly sophisticated operations.
Next, the malware allocates a memory buffer and creates a packet sniffing socket that it'll use for monitoring incoming traffic for a "magic" byte sequence.
From the compromised OSS application, the operators abused trust relationships between network segments to pivot from the transport network into the mobile Core network.
Here, the attackers gained privileged access to a Kubernetes container where BPFdoor was deployed.
“Reverse shell (TCP/UDP/ICMP) leveraged as a pivot point to access and laterally move to additional systems within the network.”
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts
For example, if a webapp exists on port 443, it can listen and react on the existing port 443, and the implant can be reached over the webapp port (even with the webapp running).
After establishing a connection with the C2, the malware sets up a reverse shell and waits for a command from the server.
When the magic packet is received by the host, the implant will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port... traffic will look like TLS/SSL traffic but in fact the attacker is interacting with a remote root shell.
“C2 communication established over raw TCP, UDP, or ICMP packets, using ‘magic bytes’ to maintain stealth and evade traditional application-layer inspection.”
22 Upload a file to the host in chunks, appending on resume.
BPFDoor and Rekoobe samples wait for a magic packet before opening interactive access.
If a packet is observed that matches the BPF filters and contains the required data it is passed to the backdoor for processing... [it] looks for a so-called magic packet.
The BPFDoor variants create a raw PF_PACKET socket, attaching a classic BPF filter.
this backdoor provided the attackers with simple yet powerful capabilities, such as a remote access to the infected systems.
It opens a new listening socket on an inconspicuous port (42391 - 43391).
We can deduce from this that the backdoor can be triggered by three different means: 1) An UDP packet starting with the bytes 0x7255 2) An ICMP packet also starting with the bytes 0x7255 3) A TCP packet starting with the bytes 0x5293.
The implant uses RC4 as the encryption layer... The real implant would require the correct password and RC4 encryption layer to see these results.
21 Download a file from the host, with resume support.
158 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.