MEDIUM Threat Intel #Linux #Backdoor #Ransomware

Linux Backdoors Target Telecom Networks with Regional Spoofing

2026-10-07 03:19 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Telecommunications and network appliances in South Korea and Taiwan are targeted by customized Linux backdoors designed for espionage.
Affected systems: Linux-based network devices, edge proxies, and enterprise email security appliances including SpamSniper and ShareTech.
Remediation: Audit raw packet sockets, inspect outbound TCP port 25 traffic from non-mail processes, and restrict management access to edge devices.

Overview of Linux Backdoor Campaign

Recent telemetry analysed by Rapid7 reveals a sophisticated campaign deploying Linux backdoors against telecommunications providers and network appliances in South Korea and Taiwan. Threat actors are tailoring their tooling to blend seamlessly into specific regional environments by impersonating local enterprise products and standard operating system components. According to research published by The Hacker News, the malicious artifacts include novel variants of BPFDoor, a BPF-based Rekoobe build, and a previously undocumented Linux implant named AVERAT.

Technical Analysis and TTPs

The campaign demonstrates a high degree of environment-awareness. Rather than relying solely on generic process names, the operators configure their implants to adopt the exact identities of widely deployed regional software.

BPFDoor and Rekoobe Variants in South Korea

Targeting systems in South Korea, the deployed BPFDoor variants spoof the process ID and configuration files of SpamSniper, a prominent anti-spam and email security solution produced by the Jiran Group. The malware abuses the Berkeley Packet Filter (BPF) functionality to inspect incoming network traffic passively. It remains dormant until it receives a specific “magic packet.”

To bypass modern detection engineering, operators have evolved their delivery mechanisms:

Edge Proxy Wrapping: Operators wrap trigger packets inside standard HTTPS POST requests, leveraging SSL offloading common in telecom architectures to bypass conventional deep packet inspection.
Process Masquerading: Alongside SpamSniper impersonation, certain samples adopt naming conventions such as ora_ppmond to mimic Oracle Database background processes like the Process Monitor (ora_pmon_*).
TinyShell Integration: Once activated, the malware spawns a TinyShell session, granting attackers interactive shell capabilities alongside file upload and download functionalities.

A concurrent Rekoobe-based backdoor intercepts IPv4 and IPv6 traffic across TCP, UDP, and SCTP protocols specifically targeting port 25, while simultaneously masquerading its process identifiers as components of SpamSniper.

AVERAT Deployment in Taiwan

In campaigns targeting Taiwanese infrastructure, attackers deploy a modular Linux implant dubbed AVERAT. Delivered via an ELF-based local installer found within ShareTech appliance directories, the dropper derives its decryption key from the string “ShareTech” to unpack a staging shell script.

The script extracts two primary binaries:

ntpdate: The primary installer component.
udevds: The underlying AVERAT payload.

Once executed, the components remove themselves from disk within ten seconds to minimize forensic artifacts. AVERAT establishes command-and-control communication by periodically polling a remote server over TCP port 25 every 600 to 699 seconds using an encrypted configuration.

Threat Attribution and Context

The BPFDoor iterations observed in these attacks align with historical activity attributed to the China-nexus threat cluster tracked as Red Menshen (also known as Earth Bluecrow or DecisiveArchitect). Furthermore, the integration of TinyShell aligns with toolsets historically utilised by groups such as Liminal Panda, UNC3886, and Velvet Ant, which consistently target telecommunication providers and edge network appliances.

Mitigations and Detection Guidance

Defenders operating Linux environments and edge infrastructure should prioritize the following defensive measures:

Monitor Raw Sockets: Review systems for unexpected raw packet sockets and BPF filters, particularly on hosts that do not require network packet capture capabilities.
Audit Port 25 Activity: Inspect outbound TCP port 25 connections to identify anomalous traffic originating from processes that are not legitimate mail transfer agents.
Process Verification: Scan for processes posing as common daemons or regional security products that deviate from standard binary paths or digital signatures.
Restrict Management Interfaces: Isolate and restrict management access to edge routers, firewalls, and security appliances from untrusted networks.

#Linux #Backdoor #Ransomware

X/Twitter LinkedIn Reddit HN

← Back to Articles