New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic

Rapid7 observed Linux backdoors (AVERAT and BPFDoor/BPF Rekoobe variants) targeting telecom and network-edge appliances in South Korea and Taiwan that disguise command-and-control traffic as SMTP on port 25 and name processes after legitimate services to evade detection. AVERAT checks in periodically, supports file transfer, shells, proxying and port forwarding, and reports to hard-coded relays on compromised third-party devices; some implants install PPTP VPNs to access victim networks. The report warns that mail gateways and edge proxies can be abused to hide malicious traffic and recommends monitoring for unusual raw packet sockets, BPF filters, non-mail processes connecting to port 25, and restricting management access to edge appliances.