Linux Backdoors Masquerade as Email Security Tools on South Korean and Taiwanese Appliances
Summary
Rapid7 describes BPFDoor, Rekoobe, and a newly reported implant called AVERAT targeting telecom and network appliances in South Korea and Taiwan, using trusted product names and email-like traffic to evade detection.
Key points
- The analyzed malware includes a BPFDoor variant and BPF-based Rekoobe used against South Korean targets, plus the newly reported AVERAT implant deployed against Taiwanese appliances.
- BPFDoor samples impersonate SpamSniper and Linux daemon processes; one uses BPF to inspect traffic and activate when it detects a magic packet.
- Operators reportedly adapted BPFDoor to deliver its trigger inside HTTPS POST requests, potentially evading conventional deep packet inspection.
- A BPFDoor sample launches a TinyShell session with interactive shell, upload, and download capabilities.
- AVERAT is installed by an ELF dropper on a ShareTech appliance and uses SMTP over TCP port 25 for command-and-control, polling every 600–699 seconds.
- Rapid7 recommends checking unexpected raw packet sockets and BPF filters, auditing outbound TCP port 25 connections, looking for processes impersonating daemons, and restricting edge-device management access.
Article Details
- Attack Vectors
- BPFDoor inspects incoming traffic with Berkeley Packet Filter functionality and activates upon detecting a magic packet; operators reportedly wrapped the trigger in HTTPS POST requests.
- BPFDoor and Rekoobe variants impersonated SpamSniper-related processes, while another BPFDoor sample used the process name "ora_ppmond".
- A dropper on Taiwanese ShareTech appliances decrypted and executed a shell script that staged the AVERAT payload.
- AVERAT used SMTP for command and control and periodically polled its C2 server over TCP port 25.
- Defensive Notes
- Review unexpected raw packet sockets and BPF filters on Linux systems that do not require packet capture.
- Audit outbound TCP port 25 connections from processes that are not mail services.
- Scan for processes posing as common daemons.
- Restrict management access to routers, DVRs, and other edge appliances.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mx[.]zxopfds[.]com | AVERAT command-and-control server polled over TCP port 25. |
MITRE ATT&CK
CVE
CVE-2023-2868exploiting two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors.CVE-2023-7102two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors.
Threat Actors
DecisiveArchitectNamed as an alias of Red Menshen.Earth BluecrowNamed as an alias of Red Menshen.Fire AntNamed as an alias of UNC3886.Liminal PandaIdentified as a China-nexus cluster previously attributed use of TinyShell and as having targeted telecom networks and edge devices.Red Dev 18Named as an alias of Red Menshen.Red MenshenLinked in the article to BPFDoor activity targeting telecom providers across the Middle East and Asia since at least 2021.UNC3886Identified as a China-nexus cluster previously attributed use of TinyShell and as having targeted telecom networks and edge devices; the article gives Fire Ant as an alias.UNC4841A China-nexus threat actor reported to have exploited vulnerabilities in Barracuda Email Security Gateway appliances in 2023 to deliver persistent backdoors.Velvet AntIdentified as a China-nexus cluster previously attributed use of TinyShell and as having targeted telecom networks and edge devices.
Malware
AVERATa BPF Rekoobe build used against South Korean targets, and a previously unreported Linux implant dubbed AVERAT that's delivered via a dropper and deployed against Taiwanese appliances.BPFDoorThe malicious artifacts include a new BPFDoor variant and a BPF Rekoobe build used against South Korean targets, and a previously unreported Linux implant dubbed AVERAT that's delivered via a dropper and deployedRekoobeThe malicious artifacts include a new BPFDoor variant and a BPF Rekoobe build used against South Korean targets, and a previously unreported Linux implant dubbed AVERAT that's delivered via a dropper and deployed
Vendors
Barracudaa China-nexus threat actor codenamed UNC4841 was observed exploiting two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistentJiran GroupAccording to vendor Jiran Group, SpamSniper is advertised as "Korea's leading email security solution" that defends organizations against spam, malware, and server attacks.
Products
Barracuda Email Security Gatewaythreat actor codenamed UNC4841 was observed exploiting two different vulnerabilities in Barracuda Email Security Gateway (ESG) appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors.Oracle Databasebe a reference to "ora_pmon_*," which represents the Process Monitor (PMON) background process of an Oracle Database instance.ShareTechbeyond imitating file names by assuming the identities of email security products like SpamSniper and ShareTech that are widely used in enterprise environments in South Korea and Taiwan.SpamSniperbeen found to go beyond imitating file names by assuming the identities of email security products like SpamSniper and ShareTech that are widely used in enterprise environments in South Korea and Taiwan.
Tools
Snort"Once security vendors wrote static network signatures (Suricata/Snort) to detect these Layer 4 anomalies, the operators began targeting the edge proxies," Rapid7 said. "By wrapping the magic packet in standard HTTPSSuricata"Once security vendors wrote static network signatures (Suricata/Snort) to detect these Layer 4 anomalies, the operators began targeting the edge proxies," Rapid7 said. "By wrapping the magic packet in standard HTTPSTinyShellOnce triggered, the BPFDoor sample launches a TinyShell session and supports commands to facilitate interactive shell, upload, and download capabilities. Interestingly, the use of TinyShell has been previously
Countries
South KoreaLinux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.TaiwanLinux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.