BPFDoor’s Hidden Controller Targets AMEA Sectors (Campaign)

Trend Micro uncovered BPFDoor, a previously unseen Linux backdoor controller attributed to the state‑sponsored APT Earth Bluecrow (Red Menshen). The backdoor leverages Berkeley Packet Filter (BPF) magic packets to silently activate and bypass firewalls, supports reverse shells, port redirection, and encrypted TCP/UDP/ICMP communications authenticated via a salted MD5 check, and has been observed enabling lateral movement and long‑term persistence against telecommunications, financial, and retail targets across South Korea, Malaysia, Myanmar, Egypt, and Hong Kong.