Linux Backdoors Mimic South Korean and Taiwanese Mail Security Appliances

Oct 2, 2026 · Original article ↗

Summary

Researchers describe Linux backdoors that mimic Asian mail-security appliances, use stealthy command-and-control over SMTP port 25, and exploit compromised edge devices as relays. Suggested detection includes checking for deleted executables and unexpected raw packetส.

Key points

Researchers describe BPFdoor and Rekoobe variants that mimic South Korean SpamSniper appliances, including their filenames, process IDs, and system services.
A separate campaign uses a ShareTech-themed dropper to install AVERAT, then deletes its dropped files while leaving running processes.
AVERAT and the new Rekoobe use TCP port 25 and SMTP conventions to blend command-and-control traffic with normal email activity.
The malware operators use compromised DVRs, NAS devices, and other edge equipment as relay points.
Secure email gateways are attractive targets because they sit at the network edge and often lack endpoint monitoring.
Detection suggestions include checking Linux processes for deleted executables, looking for unexpected raw packet sockets and known dropper artifacts, and monitoring outbound port 25 traffic from non-mail systems.

Article Details

Attack Vectors: BPFdoor waits for an activation code at a specific byte in incoming HTTPS requests.
BPFdoor can propagate data to identified computers within target organizations by inserting code into ICMP pings.
BPFdoor and Rekoobe mimic SpamSniper filenames, PID files, system services, and commonly used Linux services.
A ShareTech-identity dropper installs itself and AVERAT, then deletes the malicious files it dropped while leaving the processes running.
AVERAT and the new Rekoobe communicate with command-and-control servers over TCP port 25, using SMTP conventions to blend in with email traffic.
The malware uses compromised edge devices, including DVRs and NAS units, as operational relay points.
Defensive Notes: On Linux systems, check for processes whose executable has a '(deleted)' suffix under /proc and for unexpected raw packet sockets.
Check for the known dropper artifact directory /HDD/ms6x2xTo64/.
Restrict management access to edge devices.
Monitor outbound port 25 traffic from devices that are not mail services.
Establish a baseline for normal outbound mail traffic from appliances and investigate anomalies.
Network detection may require fingerprinting the implant's fixed TLS handshake; the article notes that its port can change at runtime.