Loading story…
Rapid7 reported that the China-linked espionage group Red Menshen has expanded a long-running campaign against global telecommunications providers by deploying upgraded BPFDoor implants designed for covert, persistent access inside Linux-based core infrastructure. Victims span the Middle East, Africa, Asia-Pacific, and Europe, with reporting tying activity to telecom environments in South Korea, Hong Kong, Myanmar, Malaysia, Egypt, and other regional networks. The malware abuses Berkeley Packet Filter functionality to inspect traffic from within the kernel and stays dormant until it receives specially crafted trigger packets, allowing it to avoid exposed listening ports and conventional command-and-control patterns. Researchers said the campaign supports strategic surveillance and pre-positioning, potentially exposing telecom signaling and authentication data tied to subscriber identity, mobility, and government communications.
Newly documented BPFDoor variants hide activation inside seemingly legitimate HTTPS traffic, use fixed trigger offsets and magic markers, add ICMP-based relay and shell capabilities, and in some cases beacon outbound over port 443 while masquerading as normal NTP- or management-related traffic. Rapid7 also described variants that monitor telecom-relevant protocols such as SCTP, wipe file descriptors, timestomp artifacts, run from paths such as /var/run/user/0, and disguise themselves as HPE ProLiant or Kubernetes-related processes. Alongside BPFDoor, operators used tools including CrossC2, TinyShell, Sliver, brute-force utilities, and credential theft tooling to move from exposed edge devices into telecom cores. Rapid7 released a detection script for known BPFDoor samples and urged defenders to hunt for structural indicators such as AF_PACKET socket creation, attached BPF filters, spoofed root processes, and anomalous ICMP markers rather than relying on payload inspection alone.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
SC Media reported on a Rapid7 analysis identifying seven new BPFDoor variants that improve stealth and resilience in telecom compromises. The coverage highlighted variants such as httpShell and icmpShell, along with an active-beaconing sample using NTP-themed domains.
Rapid7 published a whitepaper documenting multiple new BPFDoor variants that add stealth, persistence, and command-and-control flexibility, including ICMP shells, HTTP-based control, active beaconing over port 443, and anti-forensics features. The report also described detection opportunities based on structural network and process anomalies rather than payload inspection.
Rapid7 said the China-linked threat cluster Red Menshen has targeted telecommunications providers in the Middle East and Asia since at least 2021, using BPFDoor and other tooling to maintain covert access in telecom environments.
Rapid7 disclosed a months-long Red Menshen espionage campaign targeting telecom providers across Asia, the Middle East, and other regions. The researchers identified a previously undocumented BPFDoor variant that hides triggers inside HTTPS traffic and uses ICMP-based relays for low-noise command routing.
Rapid7 released a scanning script to help defenders detect known BPFDoor variants on Linux systems in critical infrastructure environments. The company warned the tool should complement broader detection efforts because stealthier or evolving samples may evade it.
Rapid7 reported that China-linked actors implanted long-term BPFDoor access in telecom networks to support strategic pre-positioning and surveillance. The report said the malware could hide commands in legitimate HTTPS traffic and inspect telecom signaling and authentication protocols.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcerapid7.com
Open sourcerapid7.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Analysis of the Linux backdoor **BPFDoor** shows the malware copying itself to `/dev/shm/kdmtmpflush`, changing the file’s permissions, and then re-launching the new instance through `execve` with the `--init` flag to complete setup. During execution it checks for `/var/run/haldrund.pid` to avoid multiple starts, deletes any prior copy of the payload, and timestomps the replacement file to `2008-10-30 19:17:16 UTC` to reduce suspicion. Runtime tracing also showed the malware adopting deceptive process names including `dbus-daemon --system` and `/usr/libexec/postfix/master` to blend into normal Linux activity. The traced sample then created a raw packet socket and attached a BPF filter with `SO_ATTACH_FILTER`, enabling BPFDoor to watch for specially crafted network traffic used to activate the implant. The backdoor was reported to respond to magic packets containing hardcoded passwords such as `justforfun` or `socket`, after which it could send a ping, spawn a reverse shell, or open a bind shell. The behavior highlights a stealth-focused Linux implant that combines fileless-style staging in shared memory, process masquerading, and packet-triggered remote access.
Aug 1, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
Cisco Talos reported that **UAT-9244**, assessed with high confidence as a **China-nexus APT** closely associated with **FamousSparrow**, has targeted **critical telecommunications providers in South America** since 2024. The activity spans **Windows and Linux endpoints** as well as **network edge devices**, and introduces three previously undocumented implants: **TernDoor** (Windows), **PeerTime** (Linux/ELF), and **BruteEntry** (edge-device brute-force/scanning tooling). Public reporting noted tactical overlap between FamousSparrow and **Salt Typhoon**-linked telecom targeting, but stated there is **no conclusive evidence** directly tying UAT-9244 to Salt Typhoon. Talos detailed that **TernDoor** is a variant of **CrowDoor** (itself related to **SparrowDoor**) and is deployed via **DLL side-loading** using the legitimate `wsprint.exe` to load a malicious loader DLL `BugSplatRc64.dll`, which reads `WSPrint.dll`, decrypts it, and executes the final payload **in memory**. **PeerTime** is an ELF backdoor that leverages the **BitTorrent protocol** for malicious operations on infected Linux systems. **BruteEntry** is typically installed on edge devices to convert them into **Operational Relay Boxes (ORBs)** used for mass scanning and brute forcing services including **SSH**, **Postgres**, and **Tomcat**; additional reporting also noted prior UAT-9244 targeting of **outdated Windows Server and Microsoft Exchange** to deploy web shells as a foothold for follow-on activity.
Jun 29, 2026