Summary
- BPFDoor is a passive Linux backdoor linked to Red Menshen, a China-nexus group. It has been active since at least 2021 and is tracked by MITRE ATT&CK as S1161.
- It abuses the Berkeley Packet Filter to read traffic below the host firewall. A locked-down server can still be activated remotely with one magic packet.
- In 2026, Rapid7 identified seven new variants. Some hide triggers in HTTPS traffic, and some impersonate legitimate software on edge appliances.
- Attackers get in through internet-facing VPNs, firewalls and mail gateways, which most Australian mid-market organisations run.
- ASD’s ACSC responded to more than 1,500 incidents in 2025–26, over 20% more than the year before.
- Macquarie Cloud Services’ security team reverse-engineered BPFDoor in an Azure sandbox. They documented how it hides in memory, disguises itself, and hijacks legitimate traffic.
- Macquarie Cloud Services’ onshore 24/7 SOC cut Mean Time to Respond from 84 minutes to 3 minutes using AI-powered automation.
Silence is not the same as safety
Every security team loves a quiet dashboard. No alerts, no strange traffic, no open ports nobody asked for. But what if that silence is exactly what an attacker designed?
That is the uncomfortable question BPFDoor forces us to ask. It is a Linux backdoor built to do nothing at all, until someone sends it a very specific signal. In the meantime, it looks like an ordinary system process.
BPFDoor is not new. Researchers first documented it in 2021, and its source code leaked publicly in 2022. So why is everyone talking about it again?
Macquarie Cloud Services has been investigating BPFDoor since its earlier emergence, publishing a detailed technical analysis in June 2022. The research examined the malware’s stealth techniques, behaviour and detection methods, demonstrating the security team’s hands-on experience with this threat well before its latest developments.¹
The short answer is evolution. Across 2026, Rapid7 published a series of investigations showing the malware has grown smarter, quieter and more widespread. In October, Rapid7 Intelligence VP Christiaan Beek warned that new versions even impersonate regional software to blend in.
Meanwhile, Australia’s threat picture keeps sharpening. The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2025–26, released on 26 October 2026, shows its ACSC responded to more than 1,500 incidents. That is a rise of over 20% on the year before.²
In this article, we unpack how BPFDoor works and why it matters beyond telcos. Then we share the practical checks our security team uses to hunt it down.
What is BPFDoor?
BPFDoor is a passive, long-term backdoor for Linux systems. MITRE ATT&CK tracks it as software S1161 and links it to China-based threat actors.⁸
Its name comes from the Berkeley Packet Filter (BPF). BPF is a legitimate Linux kernel feature that filters network packets efficiently. Monitoring tools use it every day. BPFDoor abuses it to watch incoming traffic without opening a single listening port.
The binary itself is tiny. When our analyst compiled the leaked source on Debian, the result was only about 35KB. Small, focused and well written, it needs root access to run.
Who is behind it?
Security researchers attribute BPFDoor to Red Menshen, a China-nexus group also tracked as Earth Bluecrow and Red Dev 18. The group has targeted telecommunications providers across Asia and the Middle East since at least 2021. Finance and retail organisations have also been hit.
The goal is espionage, not extortion. There is no ransom note and no encrypted files. Instead, attackers want quiet, durable access they can return to for months or even years.
What changed in 2026?
In March 2026, Rapid7 described BPFDoor implants in telecom networks as some of the stealthiest digital sleeper cells it had seen. The implants mimicked hardware daemons on servers and container processes running 5G network functions.
A follow-up study analysed nearly 300 samples and identified seven new variants. Some hide the trigger inside legitimate-looking HTTPS requests. Others use ICMP, the protocol behind a simple ping, to relay commands between infected hosts.⁶
Then, in October 2026, Rapid7 reported a new variant disguised as a Korean anti-spam product. The operators had shifted focus to mail gateways and other edge appliances.⁵
How BPFDoor works: inside our analysis
Our security team took the leaked source apart in an Azure sandbox. We ran Sysmon for Linux and used Microsoft Sentinel to capture every step. Here is what we found.
These findings build on Macquarie Cloud Services’ previously published research, BPFDoor Technical Deep Dive, which documented the backdoor’s behaviour and methods of evading detection. This earlier investigation provides a foundation for understanding how the threat has continued to evolve.
Step 1: It hides in memory and covers its tracks
Once launched, BPFDoor copies itself to /dev/shm, a RAM-based folder that clears on every reboot. It renames itself kdmtmpflush, starts a forked copy and deletes the original file.
Next, it “timestomps” the binary. It sets the file date to 30 October 2008, so it never shows up in searches for recently created files.
Finally, it wipes its own environment variables. On Linux, these often reveal the SSH session and username that launched a process. With them gone, investigators lose a valuable trail.
Step 2: It wears a disguise
BPFDoor rewrites its process name to look like a normal system service. Common disguises include dbus-daemon, auditd and the postfix mail service.
As a result, an administrator running ps sees nothing unusual. The giveaway only appears when you look deeper into the /proc file system, where Linux labels the executable as “(deleted)”.
Step 3: It listens below your firewall
This is the crucial point. BPFDoor sniffs packets at a lower level than the host firewall. So even with a strict firewall in place, the implant still sees, and acts on, a magic packet.
Take a web server locked down to TCP port 443. An attacker can send a magic packet to port 443 and activate the backdoor anyway. A UDP packet or even a simple ping works too.
The filter checks for a specific value in the payload, then a password. Everything else gets ignored, which keeps CPU usage almost invisible.
Step 4: It hijacks legitimate traffic
Once activated, BPFDoor quietly rewrites the server’s iptables rules. Traffic from the attacker’s IP address gets redirected to a hidden root shell on a high port.
In our test, we connected to SSH on port 22 and got a normal SSH banner. After sending the magic packet, the same port gave us a root shell. Every other user still saw SSH as normal.
To a network monitor, the session looks like encrypted SSH or TLS traffic on a legitimate port. That is what makes BPFDoor so dangerous.
Step 5: It phones home, very quietly
If a magic packet arrives without the right password, the implant replies with a single UDP packet containing “1”. It works as a heartbeat, letting operators check which compromised hosts are still alive.
The shell also tells the system not to record command history, including MySQL history. That suggests operators spend a lot of time inside databases.
Why this matters if you're not a telco
It is tempting to file BPFDoor under “someone else’s problem”. After all, most headlines focus on global carriers. That reading misses three important points.
The way in is your edge
Red Menshen does not start with exotic zero-days in the telecom core. According to Rapid7, initial access comes through internet-facing VPN appliances, firewalls and web platforms. These include products from Ivanti, Cisco, Fortinet, Palo Alto Networks and VMware.
Most Australian mid-market organisations run at least one of those. Mail gateways and VPN boxes are also closed appliances that usually cannot run endpoint detection agents. Beek describes that combination of internet exposure, trusted access and poor visibility as ideal terrain for attackers.⁴
Australia is firmly in scope
ASD has been clear for years. Its 2024–25 report warned that state-sponsored actors routinely target Australian critical infrastructure, possibly to pre-position for disruptive attacks. In that year alone, ASD notified critical infrastructure operators of potential malicious activity more than 190 times, a 111% increase.³
The pressure has not eased. In 2025–26, ASD’s ACSC notified entities of potential malicious activity more than 4,400 times, almost 80% higher than the year before. The number of extensive compromises also rose, from 26 to 40.
Your suppliers are part of your attack surface
Even if you are not a direct target, your telco, your managed service provider and your cloud host might be. Moreover, BPFDoor is built for long, quiet stays. A compromised upstream provider could sit in the path of your data for months before anyone notices.
That is why “we haven’t seen any alerts” is not a meaningful answer for a board. As Beek put it, no outbound traffic and no alerts do not mean a system is clean.
How to hunt for BPFDoor: seven practical checks
Here is the good news. BPFDoor evades casual observation, but it is easy to spot once you know where to look. These checks come straight from our analysis and work on any Linux host with shell access.
- Find running processes with deleted binaries. Legitimate services rarely delete their own executable after starting. Run ls -alR /proc/*/exe 2>/dev/null | grep deleted and investigate anything unexpected.
- Look for empty process environments. Normal services carry environment variables. A process with a completely blank /proc/<PID>/environ deserves a closer look.
- Search for packet capture activity. Run grep packet_recvmsg /proc/*/stack and grep wait_for_more_packets /proc/*/stack. Then ask whether each matching process genuinely needs raw packet access.
- Check for known file artefacts. Look for /dev/shm/kdmtmpflush and /var/run/haldrund.pid. Treat any process running from /dev/shm as suspicious.
- Review your iptables rules. Unexpected redirect rules, especially to TCP ports 42391 to 43391, are a strong warning sign.
- Watch your network for heartbeats. Single outbound UDP packets containing only “1”, from many hosts to one IP, point to an active implant. Rapid7 also suggests flagging outbound port 25 traffic from anything that is not a mail server.
- Inspect boot scripts. BPFDoor has no built-in persistence, so attackers add their own. Check init scripts and crontab entries for unusual binaries or paths.
Don't rely on file hashes
Hashes work poorly against Linux malware like this. Attackers can recompile the source in seconds and produce a brand new fingerprint. Behaviour-based hunting is far more reliable.
You can also scan proactively. Because the implant answers incorrect passwords with that “1” reply, a crafted magic packet can reveal infected hosts. Open-source tools such as SnapAttack’s bpfdoor-scanner and Rapid7’s detection script automate this.⁷
Report what you could not see
Finally, be honest about blind spots. Beek recommends that boards hear three things: what you searched, what you could not see, and who will close that gap by when. A green dashboard is not proof.
Five ways to shrink your exposure
- Patch your edge first. VPNs, firewalls and mail gateways are the front door for this campaign. Prioritise vendor security updates for internet-facing appliances over everything else.
- Lock down management access. Never expose appliance admin interfaces to the internet. Add multi-factor authentication, so a stolen credential does not hand over the keys.
- Restrict root. BPFDoor needs root to run. Tight privileged access controls and audited sudo use raise the bar for attackers considerably.
- Monitor Linux like you monitor Windows. Many organisations watch Windows endpoints closely but treat Linux servers as set-and-forget. Deploy Sysmon for Linux or an equivalent and feed it into your SIEM.
- Ask your vendors hard questions. If an appliance cannot run an agent, ask how you can verify its integrity. Otherwise, as Beek warns, you are outsourcing trust without outsourcing accountability.
How Macquarie Cloud Services can help
Threats like BPFDoor reward patience. Unfortunately, most mid-market IT teams have very little of it to spare. A handful of people cannot watch every Linux server, appliance and log source around the clock.
That is where our Security Operations Centre comes in. Our analysts research threats like this one hands-on, then turn that research into detections for our customers.
Macquarie Cloud Services’ work on BPFDoor is not limited to its original investigation. The security team continues to monitor emerging threats and developments in attacker techniques, using threat intelligence and hands-on research to inform its detection and response capabilities. Its earlier BPFDoor publication reflects an established approach to identifying and understanding sophisticated threats before they become widely recognised.
- 24/7 detection and response, run onshore by security-cleared engineers in Australia.
- Speed that matters. Our AI-powered SOC Optimiser brought our Mean Time to Respond down from 84 minutes to 3 minutes. Containment takes an average of 7 minutes.
- Signal, not noise. We process more than 50 million security events a day, and AI-driven filtering cuts false positives by more than 80%.
- Threat intelligence that’s built for Australia, drawn from more than 40 threat feeds and our work with Australian federal government agencies.
- Named people who know your environment, so you never have to explain your setup twice during an incident.
Start with a conversation
Not sure whether your Linux estate or edge appliances could be hiding something? Talk to our security team. We’ll help you work out what you can see today, what you can’t, and how to close the gap.
Get in touch with our security specialists or call 1800 004 943.
Frequently asked question
Can a firewall stop BPFDoor? Not on its own. BPFDoor reads packets below the host firewall, so it sees magic packets the firewall would otherwise block. Perimeter controls help, but any port open to the internet can still carry a trigger.
Does BPFDoor only affect telecommunications companies? Telcos are the main target, but Red Menshen has also hit finance and retail organisations. The entry points, such as VPNs, firewalls and mail gateways, exist in almost every business.
Will antivirus software detect it? Not reliably. Attackers can recompile the code to change its signature, and many edge appliances cannot run endpoint agents. Behaviour-based hunting and continuous monitoring work far better.
Does rebooting remove it? The in-memory copy disappears, because /dev/shm clears on reboot. However, attackers usually add their own persistence scripts, so assume a copy exists elsewhere on disk.
What should I do if I find signs of it? Isolate the host, preserve evidence and avoid tipping off the attacker. Then report the incident to ASD’s ACSC through cyber.gov.au or call the Australian Cyber Security Hotline on 1300 CYBER1.
The bottom line: BPFDoor proves that silence can be a strategy. The organisations that catch it are the ones that keep looking, even when everything seems quiet.
Resources
¹ Macquarie Cloud Services, BPFDoor Technical Analysis: An Evasive Linux Backdoor, Debarghaya Dasgupta (internal deep dive).
² Australian Signals Directorate, Annual Cyber Threat Report 2025–26, published 26 October 2026. Year-in-review figures: cyber.gov.au.
³ Australian Signals Directorate, Annual Cyber Threat Report 2024–25, published 14 October 2025. Critical infrastructure figure via iTWire.
⁴ Help Net Security, What the BPFDoor backdoor tells us about attacks on the network edge, 9 October 2026.
⁵ Rapid7, SMTP is the key: BPFDoor and AVERAT hitting the network edge, October 2026.
⁶ The Hacker News, China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks, 26 March 2026 (updated with Rapid7’s seven new variants).
⁷ Help Net Security, Researchers release tool to detect stealthy BPFDoor implants, 26 March 2026.
⁸ MITRE ATT&CK, BPFDoor, Software S1161, last modified 12 May 2026.
⁹ Macquarie Cloud Services, SOC Optimiser blog (MTTR, containment and event-volume figures).
Debarghaya Dasgupta
Contact us
Talk to an expert.
Let’s talk about where you are and what better looks like for your business.
- 1800 004 943
- Level 15, 2 Market Street Sydney, NSW, Australia