Red Menshen Campaign Uses BPFDoor Implants for Telecom Espionage
Summary
Rapid7 describes a campaign attributed to Red Menshen that uses BPFDoor for stealthy access in telecom networks. The report details kernel-level packet triggers, HTTPS camouflage, ICMP communications and SCTP support.
Key points
- Rapid7 attributes long-term telecom network access and espionage activity to Red Menshen, also tracked as Earth Bluecrow, DecisiveArchitect and Red Dev 18.
- BPFDoor uses a Linux kernel BPF filter to detect specially crafted packets and trigger a remote shell without an exposed listening port or obvious beacon.
- A newer BPFDoor variant reportedly hides its activation marker in HTTPS traffic and checks for the string “9999” at a fixed request offset.
- The newly described sample uses ICMP for communication between infected hosts; some BPFDoor artifacts also support SCTP, potentially enabling monitoring of telecom protocols.
- Rapid7 says initial access targets exposed edge services and appliances; reported post-access tools include CrossC2, Sliver, TinyShell, keyloggers and brute-force utilities.
- The article describes the implants as a means of maintaining low-noise access and moving laterally within compromised environments.
Article Details
- Attack Vectors
- The article says the campaign gains initial access by exploiting internet-facing infrastructure and exposed edge services, including VPN appliances, firewalls, and web-facing platforms.
- BPFDoor installs a BPF filter in the Linux kernel to detect specially crafted trigger packets and spawn a remote shell.
- A controller sends activation packets and can reportedly masquerade as a legitimate system process, triggering implants on internal hosts or opening a local listener for shell connections.
- A BPFDoor variant conceals its activation marker in HTTPS traffic, checking for the string "9999" at a fixed byte offset.
- The article reports ICMP communication between infected hosts and SCTP support in certain BPFDoor artifacts.
- Post-compromise activity includes deploying CrossC2, Sliver, TinyShell, keyloggers, and brute-force utilities for credential harvesting and lateral movement.
MITRE ATT&CK
T1036 · MasqueradingThe BPFDoor controller can reportedly masquerade as a legitimate system process in the victim environment.T1040 · Network SniffingBPFDoor inspects network traffic in the kernel; the article says SCTP-capable artifacts may monitor telecom protocols.T1056.001 · KeyloggingKeyloggers are among the post-exploitation tools deployed for credential harvesting.T1059.004 · Unix ShellA specially crafted packet can cause BPFDoor to spawn a remote shell on the compromised Linux system.T1095 · Non-Application Layer ProtocolThe article reports ICMP communication between infected hosts and SCTP support in certain BPFDoor artifacts.T1110 · Brute ForceThe article says brute-force utilities are deployed for credential harvesting and lateral movement.T1190 · Exploit Public-Facing ApplicationThe article says initial access involves exploiting exposed internet-facing edge services and appliances.T1205.002 · Socket FiltersBPFDoor uses a kernel BPF filter to detect specially crafted packets that activate the backdoor.
Threat Actors
DecisiveArchitectThe article identifies DecisiveArchitect as another name for the threat cluster it calls Red Menshen, which it attributes with telecom-network espionage.Earth BluecrowThe article identifies Earth Bluecrow as another name for the threat cluster it calls Red Menshen, which it attributes with telecom-network espionage.Red Dev 18The article identifies Red Dev 18 as another name for the threat cluster it calls Red Menshen, which it attributes with telecom-network espionage.Red MenshenThe campaign's long-term espionage activity against telecom networks is attributed to Red Menshen.
Malware
BPFDoorThe actor leverages stealthy tools—most notably the Linux backdoor BPFDoor that abuses Berkeley Packet Filter functionality, hides trigger packets in HTTPS, and supports SCTP to monitor telecom protocols for persistent,TinyShellPost-exploitation tools include CrossC2, Sliver, TinyShell, keyloggers, and brute-force utilities for credential harvesting and lateral movement.
Vendors
CiscoInitial access is achieved by exploiting exposed edge services and appliances from vendors like Ivanti, Cisco, Juniper, Fortinet, VMware, and Palo Alto Networks.FortinetInitial access is achieved by exploiting exposed edge services and appliances from vendors like Ivanti, Cisco, Juniper, Fortinet, VMware, and Palo Alto Networks.IvantiInitial access is achieved by exploiting exposed edge services and appliances from vendors like Ivanti, Cisco, Juniper, Fortinet, VMware, and Palo Alto Networks.Juniper Networksservices, such as VPN appliances, firewalls, and web-facing platforms associated with Ivanti, Cisco, Juniper Networks, Fortinet, VMware, Palo Alto Networks, and Apache Struts, to obtain initial access.Palo Alto NetworksInitial access is achieved by exploiting exposed edge services and appliances from vendors like Ivanti, Cisco, Juniper, Fortinet, VMware, and Palo Alto Networks.VMwareInitial access is achieved by exploiting exposed edge services and appliances from vendors like Ivanti, Cisco, Juniper, Fortinet, VMware, and Palo Alto Networks.
Products
Apache Strutsplatforms associated with Ivanti, Cisco, Juniper Networks, Fortinet, VMware, Palo Alto Networks, and Apache Struts, to obtain initial access.LinuxThe actor leverages stealthy tools—most notably the Linux backdoor BPFDoor that abuses Berkeley Packet Filter functionality, hides trigger packets in HTTPS, and supports SCTP to monitor telecom protocols for persistent,
Tools
CrossC2Post-exploitation tools include CrossC2, Sliver, TinyShell, keyloggers, and brute-force utilities for credential harvesting and lateral movement.SliverPost-exploitation tools include CrossC2, Sliver, TinyShell, keyloggers, and brute-force utilities for credential harvesting and lateral movement.