Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Summary: Rapid7 examined Linux backdoors hitting telecom and network appliances in South Korea and Taiwan that impersonate email security products SpamSniper and ShareTech, including a new BPFDoor variant, a BPF Rekoobe build, and a previously unreported implant called AVERAT delivered via an ELF dropper. The BPFDoor samples spoof SpamSniper's PID file and rotate through ten Linux daemon names, while AVERAT polls a C2 server at mx.zxopfds[.]com over TCP port 25 every 600 to 699 seconds and deletes its dropper and payload files 10 seconds after staging.
Key Takeaway: Rapid7 ties BPFDoor activity to Red Menshen, a group that has targeted telecom providers across the Middle East and Asia since 2021, and notes the operators shifted to wrapping their magic packet in HTTPS POST requests once static Suricata and Snort signatures were published. The backdoors hide their command-and-control inside ordinary SMTP traffic on port 25, the same channel your mail infrastructure depends on.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026