Linux implants on Korean and Taiwanese edge appliances run from memory after erasing their files
Rapid7 tracked Linux implants on South Korean and Taiwanese edge appliances that erase their files ten seconds after launch but keep running. File scans miss them, so defenders have to hunt processes with no image on disk.
The Watch · Security desk
What happened
- The haul spans a new BPFDoor variant, a BPF Rekoobe build against South Korean targets, a dropper, and six builds of an implant Rapid7 tracks as AVERAT on Taiwanese appliances.
- The dropper derives its encryption key from the string ShareTech and writes itself into the appliance's own add-on package directory.
- The South Korean BPFDoor builds pose as the PID file of SpamSniper, a Korean anti-spam product, and rotate through ten Linux daemon names.
- One of the two staged payloads is the dropper itself, re-executing as a resident watchdog to keep the pair alive.
- The implants run as passive BPF sockets that take no listening port, and their beacons ride ordinary DNS, TCP and SMTP traffic.
Why it matters
- What it limits constraint Each build mimics the vendor software already on the box, so a hunt tuned to one site's process names does not carry to the next.
- What's now possible capability The HTTPS-wrapped trigger rides SSL offloading to reach the implant, so deep packet inspection built for Layer 4 magic bytes no longer catches it.
- What it sets up precedent The operators re-tooled once already after vendors shipped Suricata and Snort rules, so fresh signatures for this chain should be expected to age fast.
- Who's exposed exposure The affected gear includes CCTV and DVR appliances that can sit close to the network core, making a compromised camera a foothold next to core systems.
Next story · Security · 3d ago
UTA0576 gained root on a fully patched Ivanti Connect Secure VPN 10 days before the fixConfirmed10 publishers
Rapid7's reconstruction of the BPFDoor controller shows the trigger adapting to defenders. Older variants carried raw magic bytes such as 0x7255 or 0x5293 in TCP or UDP headers [5]. Vendors answered with static Suricata and Snort rules for those Layer 4 anomalies, so the operators shifted their aim to the edge proxies and wrapped the magic packet inside a standard HTTPS POST, riding the SSL offloading common in telecom networks [6][7].
Proxies rewrite headers in transit, adding X-Forwarded-For and changing User-Agent lengths, so the backdoor can no longer read its payload from a fixed offset [13]. The controller fixes that by sending padded, benign-looking requests such as POST /admin/login.aspx?id=99990, which forces the string 9999 to sit at offset 26 of the TCP payload every time [14]. The backdoor reads from there, scans forward to the \r\n\r\n terminator, and pulls the hex-encoded command out of the HTTP body [15]. While it runs, the controller renames itself to /usr/sbin/abrtd through PR_SET_NAME, and a #ifndef SOLARIS guard applies that disguise only where Linux prctl exists [16].
The South Korean BPFDoor variant opens a raw PF_PACKET socket with a classic BPF filter that matches Rapid7's Variant F, keyed to magic bytes 0x6693 for UDP, 0x4274 for TCP and 0x7820 for ICMP [17]. On a match it reads the sender's address and either connects back, when the password is gZbpx0, or opens a bind shell, when the password is sT21xf [18].
This work extends the BPFDoor controller Rapid7 reconstructed in an earlier post, "Stealthy BPFDoor Variants are a Needle That Looks Like Hay" [11]. On the appliances, the two staged payloads enter /sbin as ntpdate and udevds, names that look ordinary on a Linux box [8].
What to watch
- Whether Rapid7 names the actor behind the cluster or shows what binds the six AVERAT builds.
- Whether SpamSniper and ShareTech ship detections for the impersonated PID files and add-on directories.
- Whether the offset-26 HTTPS trigger turns up against non-telecom edge gear once the technique is public.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+12
- Incentives35
- Confidence62
Perspective Coverage
4 publishers- Builder
- Builder 29%
- Operator
- Operator 66%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Rapid7's sample set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant Rapid7 tracks as AVERAT, deployed against Taiwanese appliances.
- [2]
The BPFDoor variants seen against South Korean systems impersonate the PID file of SpamSniper, a Korean anti-spam product, and rotate through ten Linux daemon names.
- [3]
Each sample is aware of the vendor software running on the targeted systems and implements process spoofing accordingly; Rapid7 calls the common thread regionalized disguise.
- [4]
Passive BPF implants avoid conventional port scans, outbound beacons hide inside ordinary DNS and TCP traffic, and the threat actors are leveraging SMTP to stay under the radar.
- [5]
Earlier BPFDoor variants relied on raw magic bytes such as 0x7255 or 0x5293 sitting in the TCP or UDP headers.
- [6]
After security vendors wrote static Suricata and Snort signatures to detect those Layer 4 anomalies, the operators began targeting the edge proxies.
- [7]
By wrapping the magic packet in standard HTTPS POST requests and relying on SSL offloading common in telecom environments, the trigger can be delivered to the infected node in a way that may evade conventional deep packet inspection.
- [8]
A dropper's shell script stages both payloads into /sbin under the names ntpdate and udevds, launches them, and deletes each file ten seconds later while the processes keep running.
- [9]
One of the payloads is the dropper itself, re-executing as a resident watchdog, leaving both processes running without an on-disk image.
- [10]
The dropper derives its encryption key from the string ShareTech and writes into the appliance's own add-on package directory.
- [11]
The source code analysis extends the Rapid7 BPFDoor controller introduced in an earlier Rapid7 post titled 'Stealthy BPFDoor Variants are a Needle That Looks Like Hay.'
- [12]
Telecommunications and network-edge operators are most affected, including embedded devices such as CCTV and DVR systems that can sit close to the network core.
- [13]
Because proxies alter HTTP headers, adding X-Forwarded-For and changing User-Agent lengths, the malware can no longer rely on static byte offsets to find its payload.
- [14]
The new controller sends fake, benign-looking web requests such as POST /admin/login.aspx?id=99990 that are mathematically padded, guaranteeing that the string 9999 lands at exactly offset 26 of the TCP payload.
- [15]
The backdoor uses 9999 as a reference point, dynamically scans for the \r\n\r\n terminator, and extracts the hex-encoded command payload from the HTTP body.
- [16]
When running, the controller spoofs the identity of /usr/sbin/abrtd via set_proc_name and PR_SET_NAME, and a #ifndef SOLARIS guard applies the abrtd disguise only where the Linux-specific prctl function is supported.
- [17]
The South Korean BPFDoor variant creates a raw PF_PACKET socket with a classic BPF filter matching Rapid7 Variant F, using magic bytes 0x6693 for UDP, 0x4274 for TCP and 0x7820 for ICMP.
- [18]
On a match the implant extracts the source address and connects back to the sender if the password is gZbpx0, or opens a bind shell if the password is sT21xf.
Sources
4 independent publishers whose own reporting we read for this story.
- blog.rapid7.comSMTP is the key: BPFDoor and AVERAT hitting the network edge
1 article · October 2, 2026
- infosecurity-magazine.comNew Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
1 article · October 5, 2026
- scworld.comNew Linux malware mimics network edge appliances to evade detection
1 article · October 3, 2026
- thehackernews.comLinux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
2 articles · October 7, 2026
Topics and entities
Topics
- Network edge devices
- Email Security Gateways
- Telecom Security
- Command and Control
- Linux malware
Entities
- Rapid7
- ShareTech Information