Malware

BPFDoor

Also known as: JustForFun

BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.

Indicators of Compromise 4

Domain mx[.]zxopfds[.]com Filename ntpdate Filename ora_ppmond Filename udevds

MITRE ATT&CK TTPs 7

T1027
Obfuscated Files or Information
Defense Evasion
 T1055
Process Injection
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1566
Phishing
Initial Access

Source Articles

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors have been observed targeting telecom and network appliances in South Korea and Taiwan by impersonating legitimate email security tools such as SpamSniper and ShareTech to evade detection. The threat involves a new variant of BPFDoor and a previously undocumented Linux implant named AVERAT, both using process name spoofing and C2 over SMTP on port 25. The BPFDoor variants are linked to the Red Menshen threat group and use BPF-based magic packet triggering wrapped in HTTPS POST requests to bypass deep packet inspection. AVERAT is deployed via a dropper that decrypts payloads using the key 'ShareTech' and supports extensive post-compromise capabilities including shell access, file upload/download, and process manipulation.
hacker-news ·3w ago
South Korea fines telco giant KT $39 million for customer data breach
South Korea's Personal Information Protection Commission (PIPC) fined KT Corporation approximately $39 million following a data breach that exposed the personal information of over 16,600 subscribers and enabled fraudulent mobile payments. The breach originated from a lost femtocell device that attackers exploited by cloning its authentication certificate, allowing them to intercept cellular traffic including IMSI, IMEI, and SMS authentication codes. Additionally, PIPC discovered that 38 of KT's servers were infected with BPFDoor malware, a stealthy backdoor linked to the China-nexus Red Menshen group, which had gone undetected since March 2024. KT failed to report the malware infection and deleted logs, obstructing the investigation.
bleeping-computer ·3mo ago