Loading malware…
BPFDoor is a stealth Linux backdoor family, with known Linux and Solaris variants, designed for long-term cyberespionage. It abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic in or near kernel space and remains dormant until it receives specially crafted trigger packets, allowing it to avoid opening listening ports or generating typical beaconing traffic. Reported trigger mechanisms include TCP, UDP, and ICMP magic packets, and newer variants hide activation data inside legitimate HTTPS traffic and add ICMP-based inter-host control and SCTP-aware filtering. When triggered, BPFDoor can send a ping-like reply, launch a bind shell, or establish a reverse shell to an attacker-supplied IP address; some shell traffic is RC4-encrypted, and newer active-beaconing variants have used outbound port 443 with RC4-MD5. Documented stealth and anti-forensics behaviors include execution from paths such as /dev/shm and /var/run/user/0, process masquerading as legitimate services or telecom/container-related processes, lockfile creation using names such as /var/run/xinetd.lock, /var/run/kdevrund.pid, /var/run/haldrund.pid, /var/run/syslogd.reboot, timestomping via utimes(), clearing /proc/<PID>/environ, wiping file descriptors, and setting HISTFILE and MYSQL_HISTFILE to /dev/null. The malware does not appear to implement persistence internally; reporting assesses that operators add persistence externally on compromised hosts. BPFDoor is consistently associated in the provided content with the China-linked threat actor Red Menshen, also tracked as Earth Bluecrow, and has been used in long-running espionage campaigns primarily targeting telecommunications providers, with additional reported targeting of government, finance, logistics, retail, defense, and critical infrastructure organizations across Asia, the Middle East, Africa, and Europe. In telecom intrusions, reporting states BPFDoor was used for stealthy persistence and pre-positioning inside sensitive infrastructure, including OSS/NMS/EMS systems, Kubernetes-hosted 5G functions, and environments where SCTP, Diameter, and SS7-related visibility could expose subscriber identifiers, mobility events, signaling exchanges, communications metadata, and potentially authentication material. High-confidence indicators and artifacts mentioned in the content include sample hashes dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a and fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73; additional variant-linked hashes 2cc90edd9bc085f54851bed101f95ce2bace7c9a963380cfd11ea0bc60e71e0c, de472ed37e33b79e1aa37e67a680ee3a9d74628438c209543a06e916a0a86fba, ed768dd922742a597257ad684820d7562bb6be215710ec614bd041a22f3d6863, and 9ee77ed38e5bc69f841bdaba7c5e6c3bf30fd9ae94cd2e69f39834e9cec76e82; trigger-related values including 0x7255, 0x5293, 0xA9F205C3, the string "9999" at fixed offsets in some HTTPS-triggered variants, passwords/commands such as justtryit, justrobot, justforfun, socket, sockettcp, and dP7sRa3XwLm29E; and masquerade or C2 domains including ntpussl.instanthq.com, ntpupdate.ddnsgeek.com, ntpupdate.ygto.com, and ntpd.casacam.net.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This malware family seems to be tracked by PwC as BPFDoor used by the Red Menshen threat actor... This backdoor family uses a BPF filter in order to await a trigger packet, and depending on the received command will either send a ping back, launch a bind shell, or connect a remote shell to the attacker provided IP address.
BPFDoor is a state-sponsored backdoor designed for cyberespionage activities. Through our investigation of BPFDoor attacks, we unearthed a controller that hasn’t been observed being used anywhere else.
Dubbed "BPFdoor," the backdoor operates without opening ports or generating typical beaconing activity, which the cybersecurity firm said allowed the Chinese-linked actors to avoid detection across traditional endpoint and network monitoring tools.
One of the most recognized tools in its malware arsenal is a Linux backdoor called BPFDoor. "Unlike conventional malware, BPFdoor does not expose listening ports or maintain visible command-and-control channels. Instead, it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, activating only when it receives a specifically crafted trigger packet."
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Description Generated datasets for Linux Evidence of BPFdoor implant - creation of known lockfiles in attack range.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
their malware masquerades as HPE ProLiant hardware management daemons... It spoofs Docker and containerd processes... newer variants use process names tailored to the specific target environment
T1070.003: Clear History Implementation details: Injects HISTFILE=/dev/null into environment variables.
Some of the samples copied themself in the /dev/shm folder with a custom filename, before relaunching the copied sample. This technique avoid leaving traces on the target filesystem, and ensures the binary is completely removed on reboot.
In some of the samples, a function dubbed set_time was called to alter the access and modification timestamp of the binary using the utimes function.
Malware families like BPFDoor are engineered for exactly this setting with activation on “magic” packets, kernel-level stealth, and long dwell in Linux-based environments common to telcos.
BPFdoor abuses the Berkeley Packet Filter (BPF)... to install a custom filter inside the Linux kernel that silently inspects all incoming network packets. The filter watches for a specific byte sequence, a “magic packet”.
This backdoor family uses a BPF filter in order to await a trigger packet, and depending on the received command will either send a ping back, launch a bind shell, or connect a remote shell to the attacker provided IP address.
T1090: Proxy Implementation details: Uses ICMP relay to bounce traffic through internal segments.
We recently found a new passive backdoor targeting Linux and Solaris servers, wich can use TCP, UDP or ICMP packets as it’s triggers.
where the BPFdoor controller was deployed... The BPFdoor backdoor was deployed on these systems for long-term persistence.
Malware families like BPFDoor are engineered for exactly this setting with activation on “magic” packets, kernel-level stealth, and long dwell in Linux-based environments common to telcos.
such as: justtryit , justrobot , justforfun , which will establish a bind shell on ports 42391 to 42491 ; socket or sockettcp for establishing a reverse shell to an IP address provided in the packet.
75 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware family referenced as the subject of threat research on activity in telecom networks; the article does not provide further functional detail beyond indicating it is used in adversary activity analyzed for ATT&CK technique extraction.
A stealthy Linux backdoor designed for long-term persistence, activated by magic packets and associated with kernel-level stealth in telecom-like environments.
BPFdoor is a Linux backdoor implant associated with stealthy persistence and evasion on compromised systems.
A stealthy backdoor used to compromise major telecommunication networks, with new variants adding stateless command-and-control routing, HTTP traffic concealment, interactive shell access, bidirectional ICMP tunneling, RC4 encryption, UDP/ICMP hole-punching, and covert beaconing disguised as IoT telemetry or time synchronization.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.