Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Rapid7 observed sophisticated Linux backdoors—BPFDoor variants, a Rekoobe-based backdoor, and a new AVERAT implant—targeting telecom and network appliances in South Korea and Taiwan by spoofing email/security processes (SpamSniper, ShareTech) and legitimate daemons to evade detection. The implants use BPF-based packet filters, SMTP (port 25) or HTTPS-wrapped triggers for C2, support extensive remote command functionality (shells, file transfer, process control, module loading), and exhibit behaviors consistent with an APT-linked actor (Red Menshen); the report includes IOCs, C2 details, and recommendations to audit BPF filters, monitor outbound port 25, and restrict management access.