Rapid7 Details New BPFDoor Variants Using Protocol Tunneling and Stealthy C2
Summary
Rapid7 analyzes seven BPFDoor variants, detailing stealth techniques, multi-protocol triggers, ICMP shell tunneling, and an active beacon that disguises C2 as NTP-over-SSL. The research also identifies host and network detection markers.
Key points
- Rapid7 identified seven new BPFDoor variants, F–L, with features including new BPF filters, timestomping, file-descriptor wiping, and hidden files and processes.
- Variant G uses separate TCP, UDP, and ICMP capture threads with BPF filters, providing alternate trigger protocols if one is blocked.
- The icmpShell variant tunnels interactive shell traffic over ICMP; commands use the plaintext “X:” prefix, while PTY output is encrypted with RC4 using the key “icmp”.
- Variant H actively beacons to dynamic DNS domains, including ntpussl[.]instanthq[.]com, and connects over port 443 while masquerading as NTP-over-SSL.
- Reported stealth techniques include process-name masquerading, AF_PACKET sockets, environment changes intended to disable user-mode hooks, and hiding files under /var/run/user/0.
- Rapid7 recommends monitoring for ICMP sequence number 1234, invalid ICMP Code 1, AF_PACKET socket creation, and BPF filters attached to packet sockets.
Article Details
- Attack Vectors
- icmpShell carries attacker commands in cleartext with an “X:” prefix over ICMP and returns PTY output encrypted with RC4 using the hardcoded key “icmp”.
- BPFDoor variants use custom BPF filters and magic bytes to detect activation triggers over ICMP, TCP, and UDP; variant G monitors all three protocols in separate threads.
- Variant H resolves dynamic DNS C2 domains and connects over port 443, disguising encrypted shell traffic as NTP-over-SSL.
- Variant I uses a TCP port 9999 handshake with magic bytes and a hardcoded password before spawning an unencrypted reverse shell.
- Some variants use ICMP relay and proxying to tunnel shell sessions and route traffic through internal network segments.
- Variants conceal activity through process-name masquerading, FD wiping, timestomping, hidden execution paths, and attempts to disable user-mode security hooks.
- Defensive Notes
- Monitor network traffic for the hardcoded ICMP sequence number 1234 and the technically invalid ICMP Code 1 heartbeat marker.
- Monitor host activity for AF_PACKET socket creation, including SOCK_RAW and SOCK_DGRAM, and for setsockopt calls attaching BPF filters.
- Check for root processes with spoofed names or executable paths that do not exist on disk.
- Rapid7 recommends using rapid7_bpfdoor_check.sh to check for zero-byte mutex files and active BPF filters attached to packet sockets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ntpd[.]casacam[.]net | Domain described as used by BPFDoor to disguise beacon traffic as a time-check service. |
| DOMAIN | ntpupdate[.]ddnsgeek[.]com | C2 domain used by a BPFDoor variant and described as mimicking a system update service. |
| DOMAIN | ntpupdate[.]ygto[.]com | Domain described as used for dynamic DNS updates to maintain BPFDoor command-and-control access. |
| DOMAIN | ntpussl[.]instanthq[.]com | Dynamic DNS domain resolved by BPFDoor variant H for active C2 beaconing over port 443. |
| SHA256 | 195b98211d1ce968669a0740ca08d0ddcf03a2df03a47e2e70550f6c002b49e8 | Hash of a BPFDoor sample associated with the ntpussl[.]instanthq.com C2 domain. |
| SHA256 | 2cc90edd9bc085f54851bed101f95ce2bace7c9a963380cfd11ea0bc60e71e0c | Hash of a BPFDoor variant F sample identified by Rapid7. |
| SHA256 | 757e911edaf45cc135f2498c38d4db8acec39cb6aeb3a1dcc38305ab2d326fa9 | Hash of a BPFDoor sample whose BPF filtering logic is shown in the article. |
| SHA256 | 9ee77ed38e5bc69f841bdaba7c5e6c3bf30fd9ae94cd2e69f39834e9cec76e82 | Hash of a BPFDoor sample described as an HPE ProLiant-tuned variant. |
| SHA256 | ca56622773c1b6f648b1578978b57aa668df25a11e0c782be008384a6af6c2c4 | Hash of a BPFDoor variant associated with the ntpupdate.ddnsgeek[.]com C2 domain. |
| SHA256 | de472ed37e33b79e1aa37e67a680ee3a9d74628438c209543a06e916a0a86fba | Hash of a BPFDoor variant F sample identified by Rapid7. |
| SHA256 | ed768dd922742a597257ad684820d7562bb6be215710ec614bd041a22f3d6863 | Hash of a BPFDoor sample exhibiting protocol-specific threads and process-name spoofing. |
MITRE ATT&CK
T1001 · Data ObfuscationicmpShell embeds session-tracking data in ICMP headers, including a PID-derived Identifier and the hardcoded Sequence Number 1234.T1027 · Obfuscated Files or InformationVariants use stack strings to conceal passwords, paths, and static markers from basic static analysis.T1036.004 · Masquerade Task or ServiceVariants spoof process names and arguments to resemble benign daemons, including cmathreshd and hpasmlited.T1059.004 · Unix ShellicmpShell hijacks a pseudo-terminal using fork() and dup2() to provide a Unix shell.T1070.003 · Clear Command HistoryThe article reports variants setting HISTFILE=/dev/null to avoid leaving shell-history records.T1071.001 · Web ProtocolshttpShell uses formatted HTTP POST requests with hardcoded URIs and hexadecimal bodies for C2.T1090 · ProxySome variants use ICMP relay and proxying to bounce traffic through internal network segments.T1095 · Non-Application Layer ProtocolicmpShell uses crafted ICMP Echo Requests and Replies to carry shell-session traffic.T1205 · Traffic SignalingCustom magic bytes and flags serve as wake-up triggers for implant activation.T1564 · Hide ArtifactsVariants use FD wiping, timestomping, and AF_PACKET-based packet capture to conceal filesystem and network activity.T1572 · Protocol TunnelingVariants tunnel interactive shell traffic over ICMP.T1573.001 · Symmetric CryptographyicmpShell encrypts PTY output with RC4 using the hardcoded key “icmp”.
Malware
BPFDoorThe article analyzes BPFDoor-derived implants (icmpShell/httpShell and multiple Rapid7 variants) that use custom BPF filters, protocol sniffing, and protocol-tunneling C2 to achieve stealthy remote shells andhttpShellThe article analyzes BPFDoor-derived implants (icmpShell/httpShell and multiple Rapid7 variants) that use custom BPF filters, protocol sniffing, and protocol-tunneling C2 to achieve stealthy remote shells andicmpShellThe article analyzes BPFDoor-derived implants (icmpShell/httpShell and multiple Rapid7 variants) that use custom BPF filters, protocol sniffing, and protocol-tunneling C2 to achieve stealthy remote shells and