BPFDoor

Malware
9 incidents First seen 2025-12-12 Last seen 2026-10-05
Also known as
JustForFunBackdoor.Linux.BPFDOORBackdoor.Solaris.BPFDOOR.ZAJE
Overview

BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 145 15 techniques Linux in ATT&CK since 2024-09-20 updated 2026-05-12 · v1.1
Activity by month (incidents)
2025-122026-10
Sectors targeted
telecommunications · 7government · 2energy · 1
Countries targeted
KR · 4TW · 3AE · 2BH · 2IL · 2IQ · 2IR · 2JO · 2KW · 2LB · 2OM · 2PS · 2
Origin
CN · 6CA · 1KP · 1US · 1
Kinds of incident
Malware & Botnets · 4Data Breach · 2State-Sponsored & Espionage · 2Exploited Vulnerability · 1
Techniques seen in incidents
Espionage · 3Data Breach · 2Lateral Movement · 2Impersonate · 1Spoofing · 1T1059.001 - PowerShell · 1T1059.006 - Python · 1T1059.007 - JavaScript · 1T1584.004 - Server · 1T1588.001 - Malware · 1
Related actors
Contagious Interview · 1ToddyCat · 1UNC3886 · 1
Related CVEs
CVE-2025-55182 · 1
ATT&CK techniques by tactic (15)
execution T1059.004 Unix Shell
persistence T1205.002 Socket Filters
command and control T1205.002 Socket Filters
stealth T1027 Obfuscated Files or Information T1036.009 Break Process Trees T1036.011 Overwrite Process Arguments T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1205.002 Socket Filters T1480 Execution Guardrails T1480.002 Mutual Exclusion T1564.011 Ignore Process Interrupts
defense impairment T1686 Disable or Modify System Firewall T1690 Prevent Command History Logging
Incident timeline
2026-10-05
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Infosecurity-Magazine
2026-10-03
SMTP is the key: BPFDoor and AVERAT hitting the network edge.
AlienVault OTX
2026-10-02
SMTP is the key: BPFDoor and AVERAT hitting the network edge
AlienVault OTX
2026-08-26
Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
The Hacker News
2026-08-03
Infosecurity-Magazine
2026-07-30
BleepingComputer
2026-03-27
China-linked Red Menshen APT deploys stealthy BPFDoor implants in telecom networks
Security Affairs
2026-03-26
China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
The Hacker News
2025-12-12
Half of exposed React servers remain unpatched amid active exploitation
The Register - CSO