Loading malware…
BPFdoor is a stealthy passive backdoor for Linux and Solaris systems, attributed by multiple security firms to the China-linked Red Menshen threat actor, also tracked as Earth Bluecrow. It is associated with long-running cyberespionage operations against telecommunications providers and has also targeted government, logistics, education, financial-services, and retail organizations, particularly in Asia, the Middle East, and Europe. The implant uses Berkeley Packet Filter functionality to inspect inbound TCP, UDP, ICMP, and, in newer variants, SCTP traffic for authenticated magic packets. This permits it to remain dormant without a conventional listening port or routine command-and-control beaconing and allows trigger traffic to be processed before local firewall policy.
Following activation, BPFdoor can return a status response, establish a bind shell, or create a reverse shell to operator-provided infrastructure. It can support covert access over ports used by legitimate services and, in some variants, temporarily redirect traffic through local firewall rules. Newer variants add encrypted shell communications, hashed trigger credentials, packet sockets that are less conspicuous than earlier raw-socket implementations, and environment-specific process masquerading.
BPFdoor employs substantial defense evasion and anti-forensic behavior. Variants have masqueraded as legitimate processes, altered executable timestamps, removed execution artifacts, cleared process environment data, used lock files to prevent duplicate execution, and suppressed shell-history recording. The malware itself does not necessarily implement its own startup persistence; operators have used external host persistence mechanisms to retain long-term access. BPFdoor has also been deployed on high-availability servers, network-management infrastructure, cloud-hosted systems, and Kubernetes environments, where its passive communications model supports covert persistence and lateral movement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Magic-packet implants of this kind have surfaced on Linux systems, including Red Menshen's use of passive backdoors like BPFDoor inside telecom operator networks.
BPFDoor is a state-sponsored backdoor designed for cyberespionage activities. Through our investigation of BPFDoor attacks, we unearthed a controller that hasn’t been observed being used anywhere else.
Dubbed "BPFdoor," the backdoor operates without opening ports or generating typical beaconing activity, which the cybersecurity firm said allowed the Chinese-linked actors to avoid detection across traditional endpoint and network monitoring tools.
One of the most recognized tools in its malware arsenal is a Linux backdoor called BPFDoor. "Unlike conventional malware, BPFdoor does not expose listening ports or maintain visible command-and-control channels. Instead, it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, activating only when it receives a specifically crafted trigger packet."
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts... The initial report referenced above indicates that persistence scripts have been found.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
By incorporating the encryption within a static library, the malware developers achieve better stealth and obfuscation, as the reliance on external libraries like one featuring the RC4 cipher algorithm is removed.
Renames its process to kdmtmpflush... Creates a new process environment for itself and removes the old one setting (spoofing) a new process name. It changes the way it appears on the system akin to wearing a mask.
The last thing the implant does before going fully resident is wipe out the process environment... The end result is that the implant leaves the environment completely blank.
HISTFILE=/dev/null (this avoids leaving traces in Bash history files) MYSQL_HISTFILE=/dev/null
Some of the samples copied themselves in the /dev/shm folder with a custom filename, before relaunching the copied sample. This technique avoid leaving traces on the target file system, and ensures the binary is completely removed on reboot.
Alters the forked processes’ creation and modification time values, also known as timestomping
The "magic packet" concept (TCP SYN with a window of 54321) is a form of traffic signaling to activate the passive C2.
For example, if a webapp exists on port 443, it can listen and react on the existing port 443, and the implant can be reached over the webapp port (even with the webapp running).
After establishing a connection with the C2, the malware sets up a reverse shell and waits for a command from the server.
When the magic packet is received by the host, the implant will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port... traffic will look like TLS/SSL traffic but in fact the attacker is interacting with a remote root shell.
This backdoor family uses a BPF filter in order to await a trigger packet, and depending on the received command will either send a ping back, launch a bind shell, or connect a remote shell to the attacker provided IP address.
The "magic packet" concept (TCP SYN with a window of 54321) is a form of traffic signaling to activate the passive C2.
this backdoor provided the attackers with simple yet powerful capabilities, such as a remote access to the infected systems.
Upon receiving a special packet, it will modify the local firewall to allow the attacker IP address to access resources such as a spawned shell... the implant will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A passive Linux backdoor mentioned only as a comparison to SLEEPWALKER's magic-packet-triggered design.
The article title and summary describe SPECTRE with Linux rootkit capabilities; BPFdoor appears only in the tag list/sidebar content.
A backdoor malware family found on KT internal servers during the regulator’s investigation into broader security failings and breaches.
A backdoor malware family found on 38 KT servers; in this reference it is discussed as part of the broader investigation into KT's security failures and possible data exposure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.