Threat Actor 🇨🇳 China

Red Menshen

Also known as: Red Dev 18 · Earth Bluecrow

Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors using a custom backdoor referred as BPFDoor. This threat actor uses a variety of tools in its post-exploitation phase. This includes custom variants of the shared tool Mangzamel (including Golang variants), custom variants of Gh0st, and open source tools like Mimikatz and Metasploit to aid in its lateral movement across Windows systems. Also, They have been seen sending commands to BPFDoor victims via Virtual Privat Servers (VPSs) hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels. Most Red Menshen activity that has been observed took place between Monday to Friday (with none observed on the weekends), with most communication taking place between 01:00 and 10:00 UTC.131 This pattern suggests a consistent 8 to 9-hour activity window for the threat actor, with realistic probability of it aligning to local working hours.

Indicators of Compromise 4

Domain mx[.]zxopfds[.]com Filename ntpdate Filename ora_ppmond Filename udevds

MITRE ATT&CK TTPs 7

T1027

Obfuscated Files or Information

System Information Discovery

Ingress Tool Transfer

Source Articles

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors have been observed targeting telecom and network appliances in South Korea and Taiwan by impersonating legitimate email security tools such as SpamSniper and ShareTech to evade detection. The threat involves a new variant of BPFDoor and a previously undocumented Linux implant named AVERAT, both using process name spoofing and C2 over SMTP on port 25. The BPFDoor variants are linked to the Red Menshen threat group and use BPF-based magic packet triggering wrapped in HTTPS POST requests to bypass deep packet inspection. AVERAT is deployed via a dropper that decrypts payloads using the key 'ShareTech' and supports extensive post-compromise capabilities including shell access, file upload/download, and process manipulation.

hacker-news ·3w ago

South Korea fines telco giant KT $39 million for customer data breach

South Korea's Personal Information Protection Commission (PIPC) fined KT Corporation approximately $39 million following a data breach that exposed the personal information of over 16,600 subscribers and enabled fraudulent mobile payments. The breach originated from a lost femtocell device that attackers exploited by cloning its authentication certificate, allowing them to intercept cellular traffic including IMSI, IMEI, and SMS authentication codes. Additionally, PIPC discovered that 38 of KT's servers were infected with BPFDoor malware, a stealthy backdoor linked to the China-nexus Red Menshen group, which had gone undetected since March 2024. KT failed to report the malware infection and deleted logs, obstructing the investigation.

bleeping-computer ·3mo ago