Profile: Red Menshen Uses BPFDoor for Stealthy Telecom Espionage
Summary
The profile describes China-linked Red Menshen’s alleged use of BPFDoor, a packet-triggered Linux backdoor, to maintain stealthy access. It highlights telecom and network-edge targeting, exploitation for initial access, and multi-stage post-compromise tools.
Key points
- The article describes Red Menshen as a China-linked espionage actor active since at least 2021, also known as Earth Bluecrow.
- It says the group uses BPFDoor, a Linux backdoor using BPF that activates on specially crafted packets rather than relying on continuous beaconing.
- Telecommunications providers and internet-facing devices such as VPN appliances and firewalls are identified as key targets.
- The profile says initial access often involves exploiting vulnerabilities in public-facing network devices.
- After compromise, the group reportedly uses reverse shells, credential-harvesting utilities, and other tools for lateral movement and control across Linux and Windows systems.
- The stated objective is long-term access for intelligence collection, including communications and metadata, rather than rapid disruption.
Article Details
- Topic
- Red Menshen’s use of BPFDoor for stealthy persistence and espionage in telecommunications and network infrastructure
MITRE ATT&CK
T1059 · Command and Scripting InterpreterReverse shells and cross-platform frameworks are used for post-compromise command execution.T1078 · Valid AccountsThe article reports that the group uses harvested credentials for persistence and lateral movement.T1095 · Non-Application Layer ProtocolBPFDoor uses kernel-level BPF functionality and packet-triggered command activation rather than standard command-and-control communication.T1190 · Exploit Public-Facing ApplicationRed Menshen is reported to exploit vulnerabilities in internet-facing network devices, including VPN appliances, firewalls, and enterprise network equipment, to gain initial access.T1480 · Execution GuardrailsBPFDoor activates only after receiving specially crafted packets, conditioning its operation on a specific trigger.
Threat Actors
Earth BluecrowThe article identifies Earth Bluecrow as an alias of Red Menshen, which it describes as conducting long-term cyber espionage using BPFDoor and compromised network infrastructure.Red MenshenThe article identifies Red Menshen as a China-linked APT active since at least 2021 and describes its use of BPFDoor and exploitation of internet-facing devices for long-term cyber espionage.
Malware
Products
Countries
CambodiaEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.EgyptEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.IndiaEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.MyanmarEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.South KoreaEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.ThailandEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.TurkeyEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.VietnamEgypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the US, Vietnam, and Cambodia.