Loading malware…
BPFDoor is a stealthy passive backdoor family targeting primarily Linux, with documented Solaris variants, designed to provide long-term covert access to compromised systems. It derives its name from its use of Berkeley Packet Filter functionality to inspect inbound network traffic for specially crafted trigger packets rather than exposing a conventional listening service or relying on noisy beaconing. This design allows the implant to coexist with legitimate services on common ports, evade routine port-based discovery, and in many cases observe trigger traffic before host firewall filtering is applied.
Once activated by a valid magic packet and associated authentication material, BPFDoor can send a simple status response, spawn a bind shell, or initiate a reverse shell to attacker-supplied infrastructure. Multiple analyses also describe temporary packet redirection or firewall manipulation to route traffic from legitimate service ports to the hidden shell, then remove those changes to reduce forensic traces. Newer variants have evolved beyond earlier RC4-based implementations, adding stronger transport protection, embedded certificates, reverse-shell-centric operation, statically linked components, hashed trigger material, and additional protocol support including HTTP-, ICMP-, and SCTP-related functionality. Recent reporting also describes variants with stateless command-and-control routing and active beaconing behavior in some branches.
The malware emphasizes defense evasion and anti-forensics. Observed behaviors include process-name masquerading as legitimate daemons, execution from volatile or deceptive locations in older variants, deletion of the original binary after launch in some samples, lock or PID files to mark residency, timestomping, clearing process environment data, shell history suppression, and use of packet sockets and BPF filters that can be overlooked during routine host inspection. Some newer variants changed socket behavior specifically to reduce visibility to defenders and moved away from older fileless execution patterns while retaining masquerading and covert activation.
BPFDoor is widely associated with the China-linked threat actor Red Menshen, also tracked by some vendors under alternate naming, and has been used in long-running cyberespionage operations. Victimology repeatedly includes telecommunications providers, with additional targeting reported against government, logistics, education, finance, and retail organizations across Asia, the Middle East, and other regions. It has been characterized as a long-dwell access capability suited to high-uptime servers and other always-on infrastructure, enabling covert persistence, re-entry, and operator access deep inside enterprise and telecom environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
The threat actor then moved laterally to an unpatched VMware ESXi server and exploited CVE-2021–21972 and CVE-2021–21974 to achieve remote code execution on multiple ESXi hosts, where the BPFdoor controller was deployed. | Rapid7 Labs published the results of a months-long investigation into a sophisticated espionage campaign targeting telecommunications providers worldwide. Their analysis, “BPFdoor in Telecom Networks: Sleeper Cells in the Backbone,” is an excellent technical deep-dive into the BPFdoor malware and its capabilities.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
PwC Threat Intelligence documented the existence of BPFDoor, a passive network implant for Linux they attribute to Red Menshen, a Chinese threat actor group.
BPFDoor is a state-sponsored backdoor designed for cyberespionage activities. Through our investigation of BPFDoor attacks, we unearthed a controller that hasn’t been observed being used anywhere else.
Dubbed "BPFdoor," the backdoor operates without opening ports or generating typical beaconing activity, which the cybersecurity firm said allowed the Chinese-linked actors to avoid detection across traditional endpoint and network monitoring tools.
One of the most recognized tools in its malware arsenal is a Linux backdoor called BPFDoor. "Unlike conventional malware, BPFdoor does not expose listening ports or maintain visible command-and-control channels. Instead, it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel, activating only when it receives a specifically crafted trigger packet."
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts... The initial report referenced above indicates that persistence scripts have been found.
Persistence would need to be initiated by the attacker in some other way such as rc or init scripts or scheduled tasks such as with crontab.
By incorporating the encryption within a static library, the malware developers achieve better stealth and obfuscation, as the reliance on external libraries like one featuring the RC4 cipher algorithm is removed.
Renames its process to kdmtmpflush... Creates a new process environment for itself and removes the old one setting (spoofing) a new process name. It changes the way it appears on the system akin to wearing a mask.
The last thing the implant does before going fully resident is wipe out the process environment... The end result is that the implant leaves the environment completely blank.
HISTFILE=/dev/null (this avoids leaving traces in Bash history files) MYSQL_HISTFILE=/dev/null
Some of the samples copied themselves in the /dev/shm folder with a custom filename, before relaunching the copied sample. This technique avoid leaving traces on the target file system, and ensures the binary is completely removed on reboot.
Alters the forked processes’ creation and modification time values, also known as timestomping
The "magic packet" concept (TCP SYN with a window of 54321) is a form of traffic signaling to activate the passive C2.
For example, if a webapp exists on port 443, it can listen and react on the existing port 443, and the implant can be reached over the webapp port (even with the webapp running).
After establishing a connection with the C2, the malware sets up a reverse shell and waits for a command from the server.
When the magic packet is received by the host, the implant will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port... traffic will look like TLS/SSL traffic but in fact the attacker is interacting with a remote root shell.
This backdoor family uses a BPF filter in order to await a trigger packet, and depending on the received command will either send a ping back, launch a bind shell, or connect a remote shell to the attacker provided IP address.
The "magic packet" concept (TCP SYN with a window of 54321) is a form of traffic signaling to activate the passive C2.
this backdoor provided the attackers with simple yet powerful capabilities, such as a remote access to the infected systems.
Upon receiving a special packet, it will modify the local firewall to allow the attacker IP address to access resources such as a spawned shell... the implant will spawn a new instance and change the local iptables rules to do a redirect from the requesting host to the shell port.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
66 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor malware family found on KT internal servers during the regulator’s investigation into broader security failings and breaches.
A backdoor malware family found on 38 KT servers; in this reference it is discussed as part of the broader investigation into KT's security failures and possible data exposure.
A stealthy Linux and Solaris backdoor that uses Berkeley Packet Filter (BPF) technology to passively monitor network traffic and can be activated with specially crafted magic packets without opening listening ports, enabling covert remote shell access and bypassing firewall protections.
A named malware family referenced as the subject of threat research on activity in telecom networks; the article does not provide further functional detail beyond indicating it is used in adversary activity analyzed for ATT&CK technique extraction.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.