Loading story…
Analysis of the Linux backdoor BPFDoor shows the malware copying itself to /dev/shm/kdmtmpflush, changing the file’s permissions, and then re-launching the new instance through execve with the --init flag to complete setup. During execution it checks for /var/run/haldrund.pid to avoid multiple starts, deletes any prior copy of the payload, and timestomps the replacement file to 2008-10-30 19:17:16 UTC to reduce suspicion. Runtime tracing also showed the malware adopting deceptive process names including dbus-daemon --system and /usr/libexec/postfix/master to blend into normal Linux activity.
The traced sample then created a raw packet socket and attached a BPF filter with SO_ATTACH_FILTER, enabling BPFDoor to watch for specially crafted network traffic used to activate the implant. The backdoor was reported to respond to magic packets containing hardcoded passwords such as justforfun or socket, after which it could send a ping, spawn a reverse shell, or open a bind shell. The behavior highlights a stealth-focused Linux implant that combines fileless-style staging in shared memory, process masquerading, and packet-triggered remote access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The analyzed BPFDoor sample sets the timestamps on /dev/shm/kdmtmpflush via utimes to 2008-10-30 19:17:16 UTC as part of its execution flow. This is presented in the tracing analysis as an anti-forensics step after copying and re-executing itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported that the China-linked espionage group **Red Menshen** has expanded a long-running campaign against global telecommunications providers by deploying upgraded **BPFDoor** implants designed for covert, persistent access inside Linux-based core infrastructure. Victims span the Middle East, Africa, Asia-Pacific, and Europe, with reporting tying activity to telecom environments in South Korea, Hong Kong, Myanmar, Malaysia, Egypt, and other regional networks. The malware abuses Berkeley Packet Filter functionality to inspect traffic from within the kernel and stays dormant until it receives specially crafted trigger packets, allowing it to avoid exposed listening ports and conventional command-and-control patterns. Researchers said the campaign supports strategic surveillance and pre-positioning, potentially exposing telecom signaling and authentication data tied to subscriber identity, mobility, and government communications. Newly documented BPFDoor variants hide activation inside seemingly legitimate **HTTPS** traffic, use fixed trigger offsets and magic markers, add **ICMP-based** relay and shell capabilities, and in some cases beacon outbound over port `443` while masquerading as normal NTP- or management-related traffic. Rapid7 also described variants that monitor telecom-relevant protocols such as **SCTP**, wipe file descriptors, timestomp artifacts, run from paths such as `/var/run/user/0`, and disguise themselves as **HPE ProLiant** or Kubernetes-related processes. Alongside BPFDoor, operators used tools including **CrossC2**, **TinyShell**, **Sliver**, brute-force utilities, and credential theft tooling to move from exposed edge devices into telecom cores. Rapid7 released a detection script for known BPFDoor samples and urged defenders to hunt for structural indicators such as **AF_PACKET** socket creation, attached BPF filters, spoofed root processes, and anomalous ICMP markers rather than relying on payload inspection alone.
Jun 29, 2026
Researchers have disclosed **PamDOORa**, a Linux backdoor that abuses the **Pluggable Authentication Module (PAM)** framework to steal SSH credentials and maintain covert persistence on already-compromised `x86_64` systems. Advertised on the Russian-speaking cybercrime forum **Rehub** by an actor using the alias **"darkworm,"** the malware is positioned as a post-exploitation toolkit and was reportedly offered for sale with its source code. It intercepts credentials from legitimate users during authentication by abusing `pam_exec` and inserting a malicious PAM component into the login stack. PamDOORa also enables hidden SSH access through a **magic password** tied to a specific TCP port, while anti-forensic functions tamper with records such as `lastlog`, `btmp`, `utmp`, and `wtmp` to conceal activity and complicate investigations. Researchers said the malware appears to require prior root-level compromise for deployment, and there is **no confirmed evidence yet of active in-the-wild attacks**, but they described it as a more mature, operator-grade evolution of earlier PAM backdoor concepts because of its modular design, anti-debugging features, network-aware triggers, and builder pipeline.
Jun 29, 2026
Cyble Research & Intelligence Labs reported a new **Linux** intrusion chain dubbed **ShadowHS** that uses a highly obfuscated, multi-stage *fileless* loader to decrypt and execute payloads entirely in memory, minimizing disk artifacts and complicating forensic recovery. The loader reconstructs payloads via techniques including high-entropy encrypted blobs, runtime dependency checks, marker/offset manipulation, credential-based **AES** decryption, and `gzip` decompression, then executes from anonymous file descriptors while hiding via process/`argv` spoofing (often masquerading as `python3`). Once established, ShadowHS deploys a weaponized variant of the open-source post-exploitation tool **hackshell**, adapted into an interactive operator-controlled framework. Reported capabilities include host and security-control fingerprinting (including discovery of defensive tools/EDR), credential theft, privilege escalation, lateral movement, and data exfiltration, with an emphasis on stealthy persistence and evasion of endpoint monitoring and network controls.
Jun 29, 2026