Red Menshen’s Sleeper Cells Hijack the Global Telecom “Nervous System”

Rapid7 Labs reports that a China-linked APT dubbed Red Menshen has stealthily implanted a kernel-level Linux backdoor called BPFdoor into telecom infrastructure to enable long-term espionage; the implant leverages BPF to inspect traffic in-kernel, uses magic-packet and HTTPS-concealed triggers, mimics legitimate hardware and container services, and can expose subscriber identifiers, mobility events, and signaling protocols at population scale.