BPFDoor — Chinese Nation-State Linux Backdoor Using Berkeley Packet Filters for Covert C2 Activation — Threadlinqs Intelligence
As of 2026-05-30, BPFDoor — Chinese Nation-State Linux Backdoor Using Berkeley Packet Filters for Covert C2 Activation is a critical-severity apt threat attributed to Red Menshen (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 33 indicators of compromise.
Threat ID: TL-2026-0087 · Severity: CRITICAL · Status: ACTIVE · Category: APT
Attribution: Red Menshen · China · ESPIONAGE
BPFDoor is a stealthy Linux backdoor leveraging Berkeley Packet Filters (BPF) for covert C2 activation, attributed to Chinese nation-state APT Red Menshen (Earth Bluecrow). Active since at least 2017
BPFDoor is a highly sophisticated passive Linux backdoor designed for long-term espionage operations by Chinese nation-state threat actors. The malware's core innovation is its abuse of Berkeley Packet Filters (BPF) — a kernel-level packet filtering technology — to intercept specially crafted 'magic packets' on ANY port before the Linux firewall (netfilter/iptables) processes them. This means BPFDoor activates even on hosts with strict firewall rules blocking unauthorized traffic.
The backdoor operates in three modes: (1) bind shell — opens a local port with iptables redirect for attacker connection, (2) reverse shell — connects back to attacker infrastructure, and (3) port reuse — hijacks existing legitimate service connections (e.g., connecting through port 443 where nginx is running). Magic packets can arrive via TCP, UDP, or ICMP protocols with configurable magic byte sequences (default TCP: 0x5293).
BPFDoor's anti-forensics suite includes: process name masquerading (random selection from common daemon names like /sbin/udevd, dbus-daemon, avahi-daemon), binary self-deletion from disk while remaining memory-resident, environment variable wiping to defeat incident response, timestomping with a hardcoded 2008 epoch value, and PID file creation at /var/run/ for mutex locking.
Version 1 (2017-2023) resided in /dev/shm ramdisk, used SOCK_RAW sockets, RC4 encryption, and random process name selection from a 10-name list. Version 2 (2024-present) eliminated /dev/shm residency, switched to SOCK_DGRAM|SOCK_CLOEXEC sockets to evade raw socket detection, implemented SSL with embedded certificates replacing RC4, uses fixed (environment-matched) process names, and incorporates salted MD5 password hashes with the constant salt 'I5*AYbs@LdaWbsO'.
Code lineage analysis by HaxRob traced BPFDoor's origins to 'sniffdoor' (~2006-2007), which shared code from bindtty.c and the WNPS rootkit. The sniffdoor developer was associated with the NCPH Group, some members of which later became linked to APT41. An intermediate variant 'NotBPFDoor' (2016, submitted from Hong Kong) bridges sniffdoor and modern BPFDoor, adding boot persistence and configuration menus later stripped in production versions.
A dedicated controller binary discovered by Trend Micro in 2025 enables operators to send magic packets with password authentication, select reverse/bind shell modes, choose TCP/UDP/ICMP protocols, and customize magic byte sequences per target. The controller has never been observed outside Earth Bluecrow operations.
The April 2025 SK Telecom breach — the largest telecom breach in South Korean history affecting 23 million subscribers — was linked to BPFDoor. Investigators found 12+ malware strains on SKT's home subscriber server, with initial access potentially via exploited Ivanti VPN vulnerabilities. The breach exposed USIM authentication keys enabling SIM swapping attacks, with estimated financial impact of $5 billion over three years.
Target sectors: Telecommunications, Government, Finance, Logistics, Education, Retail
Target regions: South Korea, Hong Kong, Myanmar, Malaysia, Egypt, Middle East, Asia, Africa
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 33 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, T1505.003, T1070.006, T1036.005, T1070.004, T1562.004, T1564.010, T1095, T1572, T1205.001, T1573.002