BPFDoor’s Stealth Puts Telecom and Network-Edge Devices at Risk

Summary

Rapid7’s Christiaan Beek explains how BPFDoor silently gains access to Linux systems, why attackers target poorly monitored edge devices, and what teams can check to improve visibility.

Key points

BPFDoor is a Linux backdoor that waits for a specific “magic packet” rather than constantly beaconing or opening an obvious listening port.
Mail gateways, VPN appliances, and other edge devices are attractive targets because they face the internet and often cannot run endpoint security agents.
Access to telecom networks could expose subscriber identifiers, signaling flows, authentication exchanges, and communications metadata.
Linux checks include looking for processes with deleted executables, unexpected raw packet sockets, and outbound port 25 traffic from systems that are not mail services.
Teams should also review whether edge devices have unrestricted management access and whether credentials or vulnerabilities could provide attackers a foothold.
Beek advises leaders to report what was searched, where visibility is limited, and who will address each gap and by when.