GTPDOOR Linux Malware Targets Telecoms, Exploiting GPRS Roaming Networks

Threat hunters discovered GTPDOOR, a Linux backdoor designed for hosts adjacent to GPRS Roaming Exchanges (GRX) that leverages GTP-C Echo Request messages for covert C2 and command execution. Analysis shows the implant disguises itself (process-name stomping to 'syslog'), opens raw sockets to capture UDP messages, and can be probed from external networks; samples uploaded to VirusTotal suggest a likely link to the LightBasin (UNC1945) actor.