Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access

A China-linked APT dubbed Red Menshen is conducting a stealthy espionage campaign against global telecommunications networks by deploying a Linux kernel backdoor called BPFdoor. The malware abuses BPF to install hidden kernel filters that wait for magic packets (no open listening ports), monitors SCTP signaling used in 4G/5G to access SMS, subscriber identities and location data, and evades detection by mimicking hardware and container processes; operators also use CrossC2, TinyShell, custom keyloggers, and SSH brute-forcers to move from edge devices to core systems.