Malicious Linux Implants Mimic Asian Mail Security Products

Rapid7 Intelligence reports two linked campaigns deploying Linux backdoors that impersonate secure email gateway appliances: a Korea-focused cluster with BPFdoor and Rekoobe variants masquerading as SpamSniper, and a Taiwan-focused campaign where a ShareTech-themed dropper installs the AVERAT RAT. Both campaigns use stealthy techniques (BPF activation, deleted executables, and encrypted C2 over SMTP/port 25 that blends with normal mail traffic) and abused edge devices (DVRs, NAS) as operational relays, posing a covert espionage threat against telecoms, government, and enterprise email infrastructure.