Loading story…
Security researchers detailed BPFDoor, a stealthy Linux backdoor attributed by PwC to the China-linked group Red Menshen, describing its use in long-running intrusions against telecommunications, government, logistics, and education organizations in the Middle East and Asia. The malware is designed for covert re-entry and persistence, using raw sockets and Berkeley Packet Filter (BPF) logic to inspect network traffic for specially crafted magic packets, then launching a reverse shell, bind shell, or pingback without exposing obvious new listening services.
Researchers said BPFDoor can hide behind legitimate network activity by listening on traffic destined for existing services such as 443, allowing operators to execute commands while avoiding conspicuous firewall or port changes. Analysis showed the malware often copies itself into /dev/shm, deletes the original binary, spoofs process names, creates PID files under /var/run, and can temporarily alter iptables to hijack traffic for command and control; historical samples appeared functionally stable over time, with changes largely limited to hardcoded passwords, filenames, and process names. Elastic and other researchers published hunting guidance, YARA signatures, and tooling to help defenders identify infections.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Analysis of BPFDoor samples linked to a significant telecommunications provider breach in April 2025 showed newer Linux backdoor variants had evolved to evade existing detections. The updated malware used AF_PACKET SOCK_DGRAM sockets instead of visible raw sockets, dropped older /dev/shm fileless execution behavior, and added SSL with embedded self-signed certificates.
Deep Instinct reported a newer BPFDoor variant that replaced older RC4 and bind-shell mechanisms with static-library encryption, reverse-shell communications, and commands supplied by the C2 server. The latest sample had been submitted to VirusTotal in February 2023 and was reportedly undetected by antivirus engines at the time of analysis.
PwC attributed BPFDoor to the China-linked threat group Red Menshen and reported targeting of telecommunications, government, logistics, and education organizations across the Middle East and Asia.
PwC researchers discovered BPFDoor in 2021 and identified it as a stealthy Linux backdoor used for long-term persistence and covert re-entry.
MITRE ATT&CK documented that BPFDoor uses the Linux utimes() function to alter its executable's timestamp, adding a specific defense-evasion and anti-forensics behavior for the malware.
Elastic Security Labs published a detailed analysis of BPFDoor, describing its behavior, historical sample evolution, and stealth mechanisms. Elastic also released detection content including behavioral rules, hunt queries, six YARA signatures, a scanner, and a configuration extractor.
PwC planned to present its BPFDoor findings in June 2022, indicating an upcoming public disclosure of its research on the malware and its attribution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
sandflysecurity.com
Open sourcehaxrob.net
Open sourcebleepingcomputer.com
Open sourcedeepinstinct.com
Open sourceelastic.co
Open sourcedoublepulsar.com
Open sourceattack.mitre.org
Open sourcepwc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 reported that the China-linked espionage group **Red Menshen** has expanded a long-running campaign against global telecommunications providers by deploying upgraded **BPFDoor** implants designed for covert, persistent access inside Linux-based core infrastructure. Victims span the Middle East, Africa, Asia-Pacific, and Europe, with reporting tying activity to telecom environments in South Korea, Hong Kong, Myanmar, Malaysia, Egypt, and other regional networks. The malware abuses Berkeley Packet Filter functionality to inspect traffic from within the kernel and stays dormant until it receives specially crafted trigger packets, allowing it to avoid exposed listening ports and conventional command-and-control patterns. Researchers said the campaign supports strategic surveillance and pre-positioning, potentially exposing telecom signaling and authentication data tied to subscriber identity, mobility, and government communications. Newly documented BPFDoor variants hide activation inside seemingly legitimate **HTTPS** traffic, use fixed trigger offsets and magic markers, add **ICMP-based** relay and shell capabilities, and in some cases beacon outbound over port `443` while masquerading as normal NTP- or management-related traffic. Rapid7 also described variants that monitor telecom-relevant protocols such as **SCTP**, wipe file descriptors, timestomp artifacts, run from paths such as `/var/run/user/0`, and disguise themselves as **HPE ProLiant** or Kubernetes-related processes. Alongside BPFDoor, operators used tools including **CrossC2**, **TinyShell**, **Sliver**, brute-force utilities, and credential theft tooling to move from exposed edge devices into telecom cores. Rapid7 released a detection script for known BPFDoor samples and urged defenders to hunt for structural indicators such as **AF_PACKET** socket creation, attached BPF filters, spoofed root processes, and anomalous ICMP markers rather than relying on payload inspection alone.
Jun 29, 2026
Analysis of the Linux backdoor **BPFDoor** shows the malware copying itself to `/dev/shm/kdmtmpflush`, changing the file’s permissions, and then re-launching the new instance through `execve` with the `--init` flag to complete setup. During execution it checks for `/var/run/haldrund.pid` to avoid multiple starts, deletes any prior copy of the payload, and timestomps the replacement file to `2008-10-30 19:17:16 UTC` to reduce suspicion. Runtime tracing also showed the malware adopting deceptive process names including `dbus-daemon --system` and `/usr/libexec/postfix/master` to blend into normal Linux activity. The traced sample then created a raw packet socket and attached a BPF filter with `SO_ATTACH_FILTER`, enabling BPFDoor to watch for specially crafted network traffic used to activate the implant. The backdoor was reported to respond to magic packets containing hardcoded passwords such as `justforfun` or `socket`, after which it could send a ping, spawn a reverse shell, or open a bind shell. The behavior highlights a stealth-focused Linux implant that combines fileless-style staging in shared memory, process masquerading, and packet-triggered remote access.
Aug 1, 2026
Researchers identified **RedXOR**, a Linux backdoor disguised as a `polkit` daemon, and assessed it was likely operated by a Chinese nation-state actor based on victimology, tactics, and code overlaps with malware associated with the **Winnti** umbrella. The malware targets Linux endpoints and servers, persists through init scripts, and uses the **Adore-ng** LKM rootkit for stealth. It supports host reconnaissance, file manipulation, remote shell access, self-update and uninstall functions, rootkit deployment, and network tunneling through a modified **Rinetd** component. RedXOR communicates with command-and-control infrastructure over TCP traffic made to resemble HTTP and uses XOR-based encoding to obscure data in transit. Researchers reported low antivirus detection and observed sample uploads from **Taiwan** and **Indonesia**, while intermittent command-and-control availability suggested the operation was active during analysis. The activity was framed against broader reporting on Chinese intrusion groups, including archived references to **APT41** and long-running Chinese cyber-espionage operations, reinforcing the assessment that RedXOR fits an established pattern of Linux-focused tooling used in state-linked campaigns.
Aug 15, 2026