Rapid7 Reports China-Linked Operators Embedded Backdoors in Telecom Infrastructure
Summary
Rapid7 reports that a China-linked, unattributed actor used BPFdoor and other implants for persistent access to telecom infrastructure. Its investigation details stealth techniques and includes a scanner to help defenders identify potential BPFdoor infections.
Key points
- Rapid7 reports finding kernel implants and passive backdoors in telecom and other critical environments, describing the activity as an apparent ongoing operation for long-term access.
- The activity is not attributed to a known APT; Rapid7 says the tools could support high-level espionage, including against government networks.
- Intruders reportedly abused public-facing applications and valid accounts, targeting appliances from Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks, as well as web-facing platforms.
- BPFdoor uses Linux kernel packet filtering and can activate a shell when it detects a specific sequence in a crafted packet.
- Newer BPFdoor variants reportedly conceal triggers in HTTPS traffic, with additional proxy-aware delivery, application-layer camouflage, and ICMP control signals.
- Rapid7 observed samples mimicking enterprise platforms or containerization components and released a scanner to help identify potential infections.
Article Details
- Attack Vectors
- Public-facing applications and valid accounts were abused for initial access.
- SSH brute-forcers and brute-force utilities with pre-populated credential lists tailored to telecom environments were deployed.
- BPFdoor inspected kernel-level network traffic and activated when it received a specific byte sequence in a crafted packet; newer variants embedded the trigger in padded HTTPS traffic.
- The BPFdoor variant used proxy-aware command delivery and ICMP-based control signals.
- CrossC2 Linux beacons were used for staging, command execution, and lateral movement.
- Intruders deployed passive backdoors, kernel-level implants, credential harvesters, and custom keyloggers for persistent access.
- Defensive Notes
- Rapid7 released a scanner to help defenders identify potential BPFdoor infections.
MITRE ATT&CK
T1036 · MasqueradingSome BPFdoor samples mimicked legitimate enterprise platforms or spoofed core containerization components.T1040 · Network SniffingBPFdoor inspected network traffic using a Berkeley Packet Filter in the kernel.T1056.001 · KeyloggingCustom keyloggers were deployed.T1059.004 · Unix ShellWhen triggered, BPFdoor could spawn a bind shell or reverse shell.T1071.001 · Web ProtocolsNewer BPFdoor variants embedded triggers in HTTPS traffic and used proxy-aware command delivery.T1078 · Valid AccountsValid accounts were abused for initial access.T1095 · Non-Application Layer ProtocolThe updated BPFdoor variant used ICMP-based control signals.T1110.001 · Password GuessingThe intruders used SSH brute-forcers and brute-force utilities with pre-populated credential lists.T1205 · Traffic SignalingBPFdoor activated when a crafted packet contained a specific magic byte sequence.
Threat Actors
Malware
Vendors
CiscoThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.FortinetThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.IvantiThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.Palo Alto NetworksThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.VMwareThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.
Products
Apache StrutsThe state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.Kubernetespower modern telecommunication networks: bare-metal systems running telecom workloads, cloud-native Kubernetes environments hosting Containerized Network Functions, and the signaling protocols that coordinateLinuxOne of the central pieces of the campaign is BPFdoor, a stealthy Linux backdoor that was publicly detailed in 2021, and which uses Berkeley Packet Filter (BPF) functionality for packet inspection within the kernel,SolarisRapid7 observed several BPFdoor samples used in the wild, all ELF files, although Solaris variants also exist, and released a scanner to help defenders identify potential infections.
Tools
Cobalt StrikeAt the next step, the hackers deployed Linux beacon frameworks such as CrossC2, a Cobalt Strike-derived beacon often used by Chinese APTs for staging, command execution, and lateral movement.CrossC2At the next step, the hackers deployed Linux beacon frameworks such as CrossC2, a Cobalt Strike-derived beacon often used by Chinese APTs for staging, command execution, and lateral movement.TinyShellFor persistence, the intruders often deploy the open source passive backdoor framework TinyShell.
Countries
ChinaA China-linked state-sponsored threat actor has deployed kernel implants and passive backdoors deep within telecommunication backbone infrastructure worldwide for long-term persistence, Rapid7 reports.United StatesIn early 2024, CISA confirmed that Volt Typhoon had been “pre-positioning” across US organizations, only months after Mandiant warned of the hacking group being “clearly dug in”.