KSwapDoor
KSwapDoor is a previously unseen, professionally engineered Linux backdoor/remote access tool (RAT) designed for stealth. It was initially mistaken for BPFDoor due to shared raw-socket sniffing techniques, but differs in that its main engine functions as a peer-to-peer router enabling complex lateral movement and multi-hop routing. The malware impersonates a legitimate Linux kernel swap daemon to evade detection.
Capabilities described include: building an internal mesh network among compromised servers for resilient C2; encrypted communications using AES-256-CFB with Diffie-Hellman key exchange; an interactive shell with command execution; file operations; and lateral-movement scanning. It also includes a “sleeper” mode intended to bypass firewalls, where the implant can be “woken” via a secret/invisible signal.
KSwapDoor has been reported as a payload delivered via exploitation of the React2Shell vulnerability (CVE-2025-55182) in the campaign dubbed Operation PCPcat, which has been attributed in reporting to multiple threat actors including China-nexus groups. Based on code structure and tool overlap, KSwapDoor is assessed in the source content as likely the work of Chinese nation-state actors. No specific host/network IOCs unique to KSwapDoor are provided in the content beyond its masquerading behavior (swap daemon) and its use of encrypted, multi-hop/mesh C2.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
...leveraging the recently disclosed React2Shell (CVE-2025-55182, CVSS score: 10.0)...
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
"Almost all critical strings and configuration data are protected using RC4 encryption"
Credential Access
1 technique
Credential Access
Discovery
2 techniques
Discovery
Command and Control
4 techniques
Command and Control
"downloaders to retrieve payloads from attacker command and control (C2) infrastructure" and multiple C2 endpoints; KSwapDoor uses mesh routing and encryption
"KSwapDoor implements a sophisticated P2P mesh network allowing multi-hop routing between infected nodes"
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux remote access tool/backdoor delivered via exploitation of React2Shell; described as professionally engineered with stealth in mind.
A sophisticated Linux backdoor and remote access tool that creates a mesh network among compromised servers, uses encrypted communications, and features stealth mechanisms such as sleeper mode and process impersonation. It supports interactive shell, command execution, file operations, and lateral movement scanning.
Linux server backdoor that masquerades as the kernel swap daemon (renames to [kswapd1]), uses a P2P mesh network for multi-hop C2, encrypts C2 with AES-256-CFB + Diffie-Hellman, RC4-protects strings/config, stores RC4-encrypted config in the user home directory, daemonizes and redirects I/O to /dev/null, maintains resilience via watchdog/restart logic, and provides full remote access (interactive shell, command execution, file operations, lateral movement scanning).
Previously unseen Linux server backdoor that masquerades as the kernel swap daemon (renames to kswapd1), uses a P2P mesh for resilient C2 with strong cryptography, stores RC4-encrypted configuration, includes watchdog-style resilience, and provides full remote access (interactive shell, command execution, file operations, and lateral movement scanning).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.