Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks

Red Menshen, a China-linked APT, has been conducting long-term espionage against global telecommunications networks since at least 2021 using a stealthy Linux kernel backdoor called BPFdoor that passively inspects traffic and triggers on specially crafted packets; its kernel-level operation makes detection difficult and has prompted efforts to develop detection tools.