BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets

This report analyzes BPFDoor, a kernel-triggered backdoor that leverages Berkeley Packet Filter (BPF) filters to stealthily activate on Linux systems via magic network packets; it documents a paired controller capable of encrypted reverse shells, direct connections via iptables redirection, multi-protocol activation (TCP/UDP/ICMP), observed 2024 targets across AMEA telecommunications, retail and financial services, detection guidance (network payload signatures and IOCs), and attributes the campaign to Earth Bluecrow with medium confidence.