BPFDoor

Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.

Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.

Instead, it installs a custom BPF filter inside the kernel that silently inspects incoming traffic, activating only when it receives a specially crafted “magic packet” containing a predefined byte sequence. | At the center of this campaign is BPFdoor, a stealth Linux backdoor engineered to operate within the operating system kernel by abusing Berkeley Packet Filter (BPF) functionality.

MITRE ATT&CK Matrix Mapping Tactic: Execution T1059.004: Unix Shell Implementation details: Hijacks a pseudo-terminal (PTY) utilizing fork() and dup2().

Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.

Malware families like BPFDoor are engineered for exactly this setting with activation on “magic” packets, kernel-level stealth, and long dwell in Linux-based environments common to telcos.

A key tool is BPFdoor, a stealthy Linux backdoor that hides in the kernel and activates only when it receives a specially crafted “magic” packet.

When an adversary implants a persistent backdoor at the kernel level within these environments, they are not simply compromising a server, they are positioning themselves adjacent to subscriber data, signaling flows, and the mechanisms that authenticate and route national and international communications.

Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.

Description Generated datasets for Linux Evidence of BPFdoor implant - creation of known lockfiles in attack range.

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

So nowadays BPFdoor disguises itself using legitimate service names and process behaviors associated with HPE ProLiant servers, or Kubernetes, as applicable.

T1036.004: Masquerading Implementation details: Alters process arguments to mimic benign daemons like qmgr.

T1070.003: Clear History Implementation details: Injects HISTFILE=/dev/null into environment variables.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Attacks usually begin at the network edge by exploiting exposed services or valid accounts on devices like VPNs, firewalls, and virtualization hosts.

Malware families like BPFDoor are engineered for exactly this setting with activation on “magic” packets, kernel-level stealth, and long dwell in Linux-based environments common to telcos.

When an adversary implants a persistent backdoor at the kernel level within these environments, they are not simply compromising a server, they are positioning themselves adjacent to subscriber data, signaling flows, and the mechanisms that authenticate and route national and international communications.

T1564: Hide Artifacts Implementation details: Uses AF_PACKET sniffing to remain invisible to local netstat/ss.

We found custom sniffers, custom tooling to intercept usernames and passwords — very highly sophisticated operations.

We found custom sniffers, custom tooling to intercept usernames and passwords — very highly sophisticated operations.

We found custom sniffers, custom tooling to intercept usernames and passwords — very highly sophisticated operations.

Now, instead of looking for a magic packet in any sort of network packet, the malware only looks for its trigger phrase in innocuous Hypertext Transfer Protocol Secure (HTTPS) requests.

httpShell, which prioritizes C2 concealment within HTTP traffic to allow BPF logic to view for certain magic markers in inner packets | Most critical of the novel BPFDoor versions are httpShell, which prioritizes C2 concealment within HTTP traffic to allow BPF logic to view for certain magic markers in inner packets, and icmpShell, which creates an interactive shell to impede static firewall rules while also supporting bidirectional ICMP tunnels, RC4 encryption, and UDP/ICMP hole-punching | the "H" variant including an active beacon performing NTP-themed domain resolution and opening encrypted sessions under the guise of IoT telemetry or time synchronization

T1090: Proxy Implementation details: Uses ICMP relay to bounce traffic through internal segments.

icmpShell, which creates an interactive shell to impede static firewall rules while also supporting bidirectional ICMP tunnels, RC4 encryption, and UDP/ICMP hole-punching

Malware families like BPFDoor are engineered for exactly this setting with activation on “magic” packets, kernel-level stealth, and long dwell in Linux-based environments common to telcos.

icmpShell, which creates an interactive shell to impede static firewall rules while also supporting bidirectional ICMP tunnels, RC4 encryption, and UDP/ICMP hole-punching

icmpShell, which creates an interactive shell to impede static firewall rules while also supporting bidirectional ICMP tunnels, RC4 encryption, and UDP/ICMP hole-punching

The researchers said it abuses Berkeley Packet Filter (BPF) functionality to inspect network traffic directly inside the kernel.