Sales Development Representative

BPFDoor, AVERAT Linux implants stalk telecom edge. Rapid7 Intelligence has disclosed a new modular Linux malware ecosystem that fuses fresh BPFDoor variants, a BPF-based Rekoobe build, and a novel AVERAT implant to compromise telecom and network-edge infrastructure in South Korea and Taiwan.[[1]] [[2]] [[11]] The campaigns concentrate on mail and security appliances at the perimeter, pushing command-and-control over SMTP and blending into legitimate mail flows to stay below the radar of conventional network monitoring.[[1]] [[2]] [[4]] Researchers report that the operators rely on a Linux dropper that writes a shell script to targeted appliances, staging two binaries under innocuous daemon names such as ntpdate and udevds in /sbin before deleting the files while leaving the processes resident in memory.[[1]] One payload re-executes as a watchdog to maintain persistence without an on-disk footprint, while the other carries either an AVERAT implant or a BPFDoor variant customized to the vendor platform and role of the device.[[1]] [[4]] In the South Korean cluster, the dropper derives its encryption key from the string ShareTech and resides in the appliance's add-on package directory, while BPFDoor samples spoof local SpamSniper antispam software by impersonating its PID file and rotating through benign-looking Linux daemon identities.[[1]] [[4]] A parallel cluster targets Taiwanese appliances with six AVERAT builds that adopt process names and configuration paths matching regional telecom and edge vendors, highlighting the operators' detailed knowledge of their victims' software stacks.[[1]] [[2]] Rapid7's reconstruction of the BPFDoor controller source code shows the backdoor evolving from raw Layer 4 "magic bytes" in TCP and UDP headers to HTTP-tunneled triggers wrapped in ordinary-looking HTTPS POST requests traversing edge proxies in telecom environments.[[1]] [[3]] [[15]] Because proxies add and modify HTTP headers such as X-Forwarded-For and alter User-Agent lengths, the controller can no longer rely on fixed byte offsets; instead it sends mathematically padded requests like POST /admin/login.aspx?id=99990 so that the string 9999 consistently lands at a known position, then uses that marker to locate the rnrn separator and extract a hex-encoded command payload from the HTTP body.[[1]] [[3]] The controller's dogetlogin function hard-codes realistic web login paths to blend into logs, while the running process spoofs /usr/sbin/abrtd via Linux prctl calls, applying the disguise only on non-Solaris systems.[[1]] [[15]] Newly documented flags add HTTPS POST tunneling, hidden IP fields, custom URI directories, and verbose debug output on top of older ICMP, UDP, and raw TCP trigger modes, giving operators flexible ways to activate implants and pivot within compromised networks.[[1]] [[3]] On the data plane, one newly observed BPFDoor variant creates a raw PF_PACKET socket and attaches a classic BPF filter that matches specific "magic" byte sequences in UDP, TCP, and ICMP traffic before opening shells or performing UDP knocks, depending on the password embedded in the trigger packet.[[1]] Strings inside the binary are obfuscated with a rotating substitution alphabet, but once decoded they reveal explicit product spoofing artifacts and a suite of process-name disguises that mimic common Linux daemons such as chronyd, rsyslogd, crond, and NetworkManager, alongside mutex references to /var/run/spamsniper.pid that tie the build to SpamSniper-protected mail and telecom environments in South Korea.[[1]] [[4]] A separate sample gates on a unique 14-byte payload via a 16-instruction BPF program and spoofs its identity as ora_ppmond, echoing Oracle-backed HSS and OSS/BSS platforms used by telecom providers so that the implant looks legitimate only on hosts actually running that class of infrastructure.[[1]] [[2]] Elsewhere, BPFDoor activity has been linked to the China-nexus group sometimes described as Red Menshen, but Rapid7 has not publicly pinned this latest SMTP-focused edge campaign to a specific threat actor.[[7]] [[8]] [[15]] The AVERAT implants themselves are described as modular Linux remote access tools that favor SMTP over port 25 for command-and-control, allowing attackers to hide lateral movement and exfiltration inside the same mail security traffic defenders expect to see near the network core.[[1]] [[2]] [[4]] According to independent reporting, these operations also abuse compromised consumer and small-business appliances - including NAS devices, DVRs, and broadband gateways - as relays and persistence nodes, extending the reach of the ecosystem beyond traditional carrier gear into adjacent infrastructure.[[2]] [[11]] That mix of fileless execution, vendor-specific process spoofing, passive BPF listeners, and mail-based C2 means conventional port-centric monitoring and simple process name checks are unlikely to surface the implants without more targeted hunting.[[1]] [[3]] [[9]] Rapid7 and other security firms have released BPFDoor detection scripts and guidance that focus on kernel-level BPF hooks, suspicious raw socket usage, anomalous process-command-line combinations, and unusual DNS, ICMP, or SMTP patterns, and telecom operators are being urged to apply those tools across edge proxies, mail gateways, and embedded devices as part of focused threat hunting and incident response.[[3]] [[9]] [[12]] Compare Security

Rapid7 has launched Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. The platform combines threat intelligence, vulnerability research, and the legacy of Rapid7 Labs to turn insights on attacker behaviour into AI-powered action. The company tracked 8,539 critical vulnerabilities in Q2 alone. Rapid7 Intelligence monitors threats in real time to deliver actionable, expert-validated insights. Rapid7 researchers recently uncovered a modular Linux malware ecosystem targeting telecom and network-edge devices. The discovery demonstrates the platform's ability to analyse shared behaviours and uncover emerging attack patterns. The intelligence flows directly into Rapid7 products, MDR, and Exposure Management to neutralise adversary infrastructure before attacks execute. Rapid7 serves more than 11,500 customers worldwide.

Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers TMCnet News [October 02, 2026] | / | Rapid7 Launches Rapid7 Intelligence to Harness Threat Data Against Attackers BOSTON, Oct. 02, 2026 (GLOBE NEWSWIRE) - Today, Rapid7, Inc. (NASDAQ: RPD), a global leader in AI-powered managed cybersecurity operations, announced the launch of Rapid7 Intelligence, a unified engine designed to transform enterprise threat defenses from reactive monitoring to proactive prevention. By combining threat intelligence, vulnerability research, and the legacy of Rapid7 Labs, Rapid7 Intelligence transforms insights on attacker behavior into AI-powered action to help organizations anticipate and disrupt attacks. Indicators Expire. Behavior Doesn't: Defense for the Agentic Era. Building on Rapid7 Labs' 13-year legacy, Rapid7 Intelligence turns attacker behavior into scalable protection faster than traditional vendors reliant on static indicators. With AI compressing exploitation windows to minutes - and 8,539 critical vulnerabilities tracked in Q2 alone - attackers are leveraging automation to scale phishing, reconnaissance, and script development. Rapid7 Intelligence monitors these threats in real time to deliver actionable, expert-validated insights that keep defenders ahead. "Static threat intelligence isn't completely dead - it's just sitting in standard dashboards doing what it's always done, giving organizations a false sense of security while autonomous threat agents burn down their perimeters," said Christiaan Beek, Vice President of Rapid7 Intelligence. "The real differentiator isn't hoarding more raw feeds; it's having curated, vetted intelligence focused relentlessly on true signals rather than waiting around for alerts to trigger after the damage is done. Rapid7 Intelligence isn't built to generate another 50-page PDF report for security teams to ignore; it aggressively converts real-time operational adversary insight into a proactive, preemptive shield." Rapid7 Intelligence in Action: Behavioral Correlation Exposes a Hidden Linux Malware Ecosystem A concrete illustration of Rapid7 Intelligence's power is a new finding from Rapid7 researchers, who uncovered a modular Linux malware ecosystem - spanning new BPFDoor variants, BPF Rekoobe, droppers, and AVERAT implants - actively targeting telecom and network-edge devices. Researchers identified two campaigns linked by a common focus on the network edge. Rapid7 Intelligence analyzed their shared behaviors, uncovering an emerging pattern: using SMTP to blend into the victim's DMZ, target mail security appliances, and maintain long-term access. New BPFDoor variants indicate the malware family is evolving into an ecosystem where each sample is tailored to the telco plane (control, management, and data plane) it targets, and where threat actors know exactly what software is adopted at each layer. Rapid7 Intelligence will continue tracking and disrupting tactics like this to keep defenders ahead of attackers. Expert-Led, Actionable Intelligence To continuously power research like this and help defenders stay ahead of emerging threats, Rapid7 Intelligence delivers: * Immediate Protective Force: Frontline intelligence bypasses legacy research lags, flowing directly into Rapid7 products, MDR, and Exposure Management to neutralize adversary infrastructure before attacks execute. * Unified Intelligence Engine: Threat intelligence, vulnerability analysis, and engineering inside the products customers already run, instead of a report they have to translate into action themselves. * Uncompromised Community Arsenal: Building on the legendary foundation of Metasploit and Rapid7 Labs, critical advisories, vulnerability research and exploitation insights remain open, ensuring the industry stays capable of pushing back. "In a world of infinite telemetry and automated attacks, playing defense with traditional tools is an exercise in futility," said Mel Stone, Chief Global Services Officer at Rapid7. "Rapid7 Intelligence shifts the balance of power. By fusing machine-scale observation with frontline human expertise, we turn raw threat data into immediate, actionable intelligence - empowering security teams to disrupt adversaries before they establish a foothold." To learn more about Rapid7 Intelligence, visit here. About Rapid7 Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide. For more information, visit its website, check out its blog, or follow Fog Computing World on LinkedIn or X. Media Contact Christine Nurnberger SVP Global Marketing and Growth [email protected] Rapid7 Investor Contact Christopher Keenan Vice President, Deputy General Counsel [email protected] [ Back To TMCnet.com's Homepage] |