China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks

This article covers Red Menshen, a China-linked threat actor, using the stealthy BPFDoor Linux backdoor to conduct long-term espionage via telecom networks.

• •BPFDoor abuses Berkeley Packet Filter (BPF) functionality to inspect kernel-level network traffic without exposing listening ports or C2 channels, activating only on a specially crafted trigger packet.
• •Initial access is gained through internet-facing edge services including VPN appliances and firewalls from Ivanti, Cisco, Fortinet, VMware, and others.
• •Post-exploitation tools include CrossC2, Sliver, TinyShell, keyloggers, and brute-force utilities for lateral movement and credential harvesting.
• •A newly discovered BPFDoor variant conceals trigger packets within HTTPS traffic and uses ICMP for communication between infected hosts.