Vice President, Product Management - Exposure Command & Vulnerability Management

Rapid7 Intelligence wins the 2026 Péter Szőr Award for outstanding research. Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for its research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind. Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful - exactly what he was known for himself. And as far as recognitions in its industry go, it's hard to top. I'm extremely proud. What the pèter Szőr Award means to Rapid7. I knew Péter, and early in my career, I learned from him. This was back when malware analysis meant staring at assembly, arguing about what a routine really did, and realizing hours later that your first theory was wrong. One memory came straight back when I heard about the award: going through Stuxnet together. For anyone in research at the time, that was the moment you knew the game had changed. Engineering, tradecraft, espionage and physical-world consequences, all in one package. What stayed with me wasn't how much Péter knew, but rather his curiosity. He wanted to understand things, and then once he did, he wanted everyone else to understand too. Plenty of brilliant people in cybersecurity keep it to themselves, but the ones who leave a legacy make the people around them better. Receiving an award that carries his name felt like one of those full-circle moments. The research behind the award. The original research from Rapid7 Intelligence emerged after months of investigating stealthy access inside telecommunications environments. This wasn't malware dropped during a conventional intrusion, but long-term strategic positioning: passive backdoors, kernel-level capabilities and covert access, quietly settled into critical infrastructure and in no hurry whatsoever. Telecom networks carry its communications, its identities and, increasingly, everything governments and businesses run on. So when an adversary sets up camp there, the impact goes well beyond one compromised machine or one unlucky company. Virus Bulletin's community nomination noted that the work paired deep technical investigation with real-world impact, including long hours with agencies and CERTs around the world and tools, scripts, intelligence and detection capabilities for defenders. That's the part I'm happiest about, as this wasn't research for publication alone. Remember that a PDF has never stopped an intrusion. Publishing research is a checkpoint, not the finish line. Rapid7 is still doing the research. Since the original report, Rapid7 Intelligence has analyzed hundreds more samples, found previously undocumented BPFDoor variants, and tracked changes in the operators' tradecraft. Its follow-up work covered new httpShell and icmpShell variants built to make detection even harder. In further publications, Rapid7 went beyond BPFDoor to additional Linux implants and infrastructure targeting telecom and network-edge environments, including AVERAT and techniques that hide in ordinary-looking traffic like SMTP. That's how this work goes. You find something, you share it, someone sends you another sample, a CERT spots something in their environment, an analyst notices the one odd function nobody looked at twice, and you're back down the rabbit hole. Anyone who thinks an initial report is the finish line has never received "just one more sample" at 4 p.m. on a Friday. And truthfully, I also love that this happens in the open. From the outside, its industry looks like a cage match over attribution, naming conventions and whose acronym is cooler. But when something truly matters, researchers, vendors, CERTs and governments put that aside and share, because protecting people beats winning the naming argument. This award belongs to the team: Rapid7 Intelligence. Research like this never belongs to just one or two people. It belongs to the analysts still staring at code after everyone else has gone home, the people who question an assumption because something doesn't add up, the people that keep the show running, and the detection engineers who turn findings into something defenders can use. It also belongs to the people collecting samples, maintaining infrastructure and correlating intelligence, and to the CERTs, agencies and peers who trusted Rapid7 enough to share what they saw. I'm proud of the Rapid7 Intelligence team, and not because of the trophy. I'm proud of why Rapid7 got it: Rapid7 took a hard problem, did the hard work, and then tried to make the result useful to someone else. To the next generation of research. Today, the conversation has evolved to include autonomous agents, AI-generated malware and machine-speed attacks. Tomorrow it'll be something new. My motivation stays the same: I want to leave the digital world a little safer for the generations that come after Rapid7. Somewhere right now, a young researcher is opening a debugger for the first time and wondering how on earth the thing works. Someone will investigate the Stuxnet of their generation, and someone will eventually sit in the chair I'm in now. Its job isn't just to detect today's attacks. It's to share what Rapid7 learn, build tools, mentor people and make sure they start a few steps ahead of where Rapid7 did. Péter did that for its industry, and he did it for me. Thank you to Virus Bulletin and its peers in the security community for this recognition, to everyone who contributed to the research, publicly or behind the scenes, and to Péter, who taught a young malware researcher that taking things apart is only half the job. The other half is making sure somebody else can learn from what you found. Article tags.

BPFDoor, AVERAT Linux implants stalk telecom edge. Rapid7 Intelligence has disclosed a new modular Linux malware ecosystem that fuses fresh BPFDoor variants, a BPF-based Rekoobe build, and a novel AVERAT implant to compromise telecom and network-edge infrastructure in South Korea and Taiwan.[[1]] [[2]] [[11]] The campaigns concentrate on mail and security appliances at the perimeter, pushing command-and-control over SMTP and blending into legitimate mail flows to stay below the radar of conventional network monitoring.[[1]] [[2]] [[4]] Researchers report that the operators rely on a Linux dropper that writes a shell script to targeted appliances, staging two binaries under innocuous daemon names such as ntpdate and udevds in /sbin before deleting the files while leaving the processes resident in memory.[[1]] One payload re-executes as a watchdog to maintain persistence without an on-disk footprint, while the other carries either an AVERAT implant or a BPFDoor variant customized to the vendor platform and role of the device.[[1]] [[4]] In the South Korean cluster, the dropper derives its encryption key from the string ShareTech and resides in the appliance's add-on package directory, while BPFDoor samples spoof local SpamSniper antispam software by impersonating its PID file and rotating through benign-looking Linux daemon identities.[[1]] [[4]] A parallel cluster targets Taiwanese appliances with six AVERAT builds that adopt process names and configuration paths matching regional telecom and edge vendors, highlighting the operators' detailed knowledge of their victims' software stacks.[[1]] [[2]] Rapid7's reconstruction of the BPFDoor controller source code shows the backdoor evolving from raw Layer 4 "magic bytes" in TCP and UDP headers to HTTP-tunneled triggers wrapped in ordinary-looking HTTPS POST requests traversing edge proxies in telecom environments.[[1]] [[3]] [[15]] Because proxies add and modify HTTP headers such as X-Forwarded-For and alter User-Agent lengths, the controller can no longer rely on fixed byte offsets; instead it sends mathematically padded requests like POST /admin/login.aspx?id=99990 so that the string 9999 consistently lands at a known position, then uses that marker to locate the rnrn separator and extract a hex-encoded command payload from the HTTP body.[[1]] [[3]] The controller's dogetlogin function hard-codes realistic web login paths to blend into logs, while the running process spoofs /usr/sbin/abrtd via Linux prctl calls, applying the disguise only on non-Solaris systems.[[1]] [[15]] Newly documented flags add HTTPS POST tunneling, hidden IP fields, custom URI directories, and verbose debug output on top of older ICMP, UDP, and raw TCP trigger modes, giving operators flexible ways to activate implants and pivot within compromised networks.[[1]] [[3]] On the data plane, one newly observed BPFDoor variant creates a raw PF_PACKET socket and attaches a classic BPF filter that matches specific "magic" byte sequences in UDP, TCP, and ICMP traffic before opening shells or performing UDP knocks, depending on the password embedded in the trigger packet.[[1]] Strings inside the binary are obfuscated with a rotating substitution alphabet, but once decoded they reveal explicit product spoofing artifacts and a suite of process-name disguises that mimic common Linux daemons such as chronyd, rsyslogd, crond, and NetworkManager, alongside mutex references to /var/run/spamsniper.pid that tie the build to SpamSniper-protected mail and telecom environments in South Korea.[[1]] [[4]] A separate sample gates on a unique 14-byte payload via a 16-instruction BPF program and spoofs its identity as ora_ppmond, echoing Oracle-backed HSS and OSS/BSS platforms used by telecom providers so that the implant looks legitimate only on hosts actually running that class of infrastructure.[[1]] [[2]] Elsewhere, BPFDoor activity has been linked to the China-nexus group sometimes described as Red Menshen, but Rapid7 has not publicly pinned this latest SMTP-focused edge campaign to a specific threat actor.[[7]] [[8]] [[15]] The AVERAT implants themselves are described as modular Linux remote access tools that favor SMTP over port 25 for command-and-control, allowing attackers to hide lateral movement and exfiltration inside the same mail security traffic defenders expect to see near the network core.[[1]] [[2]] [[4]] According to independent reporting, these operations also abuse compromised consumer and small-business appliances - including NAS devices, DVRs, and broadband gateways - as relays and persistence nodes, extending the reach of the ecosystem beyond traditional carrier gear into adjacent infrastructure.[[2]] [[11]] That mix of fileless execution, vendor-specific process spoofing, passive BPF listeners, and mail-based C2 means conventional port-centric monitoring and simple process name checks are unlikely to surface the implants without more targeted hunting.[[1]] [[3]] [[9]] Rapid7 and other security firms have released BPFDoor detection scripts and guidance that focus on kernel-level BPF hooks, suspicious raw socket usage, anomalous process-command-line combinations, and unusual DNS, ICMP, or SMTP patterns, and telecom operators are being urged to apply those tools across edge proxies, mail gateways, and embedded devices as part of focused threat hunting and incident response.[[3]] [[9]] [[12]] Compare Security