Hackers Plant Stealthy BPFdoor Backdoors in Telecom Networks for Long-Term Access

Rapid7 Labs uncovered a sophisticated, state-linked campaign by Red Menshen that implants a stealthy kernel-level backdoor (BPFdoor) into telecom core infrastructure across multiple countries. The implant hides triggers inside decrypted HTTPS traffic and uses ICMP-based control channels, impersonates legitimate telecom/server processes, and targets edge infrastructure (VPNs, network devices, ESXi) to enable long-term espionage and large-scale collection of subscriber and signaling metadata. Rapid7 released detection tooling and coordinated disclosures with CERTs.