China Upgrades the Backdoor It Uses to Spy on Telcos Globally

Researchers report that Chinese APT "Red Menshen" has upgraded the BPFdoor Linux kernel backdoor to more stealthily maintain persistence and control within global telecommunications, government, and critical infrastructure networks. Enhancements include detecting an HTTPS activation phrase at the 26th byte offset, an ICMP-based control channel that routes commands to specific implants using a 0xFFFFFFFF marker, and process disguises tailored to HPE ProLiant and Kubernetes environments, enabling covert, high-fidelity reconnaissance and lateral control across victim networks.