Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor | Qualys
Summary: Qualys researchers detailed BPFDoor, a Linux/Unix backdoor that uses Berkeley Packet Filters to attach a network filter to a socket and supports TCP, UDP, and ICMP for command-and-control, attributed to a Chinese threat actor group called Red Menshen (aka DecisiveArchitect) and used for stealthy remote access since 2018. The implant, tracked as "JustForFun," overwrites its process command line with one of ten hard-coded daemon-like names, renames itself via prctl with PR_SET_NAME, timestomps the binary to Thursday, October 30, 2008 7:17:16 PM GMT, and creates a zero-byte PID file at /var/run/haldrund.pid.
Bottom line: Red Menshen has compromised systems across the US, South Korea, Hong Kong, Turkey, India, Vietnam, and Myanmar, targeting telecommunications, government, education, and logistics organizations, and routes commands through VPSs administered via compromised routers in Taiwan used as VPN tunnels.
Read the original at Qualys Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026