Linux Backdoors Are Dressing Up as Your Email Security Software

If you glance at a process list and see something named after your spam filter, you probably move on. That is exactly what these attackers are counting on.

According to The Hacker News’ write-up of new Rapid7 research, Linux backdoors aimed at telecom and network appliances in South Korea and Taiwan are copying more than file names. They take on the identities of email security products that are widely used in those regions.

What was reported

Rapid7 examined several artifacts:

• A new BPFDoor variant and a BPF Rekoobe build, both used against South Korean targets.
• A previously unreported Linux implant called AVERAT, delivered through a dropper and deployed against Taiwanese appliances.

The BPFDoor samples impersonate the PID file of SpamSniper, a Korean anti-spam product from Jiran Group, and rotate through ten Linux daemon names. Another sample sets its process name to ora_ppmond. That looks like a nod to ora_pmon_*, the Process Monitor background process of an Oracle Database instance, and it fits the Oracle-backed subscriber and provisioning platforms common in telecom.

Rapid7’s summary of the pattern: “The common thread is regionalized disguise: each sample is aware of the vendor’s software running on the targeted systems and implements process spoofing accordingly.”

BPFDoor keeps evolving

BPFDoor abuses the Berkeley Packet Filter to inspect incoming traffic. It stays quiet until it sees a magic packet. Once triggered, the sample launches a TinyShell session with interactive shell, upload and download support.

The article links BPFDoor to a group Rapid7 tracks as Red Menshen, which has targeted telecom providers in the Middle East and Asia since 2021. It also notes that TinyShell has previously been tied to China-nexus clusters such as Liminal Panda, UNC3886 and Velvet Ant.

The interesting part is how the operators adapted. Rapid7 says that after security vendors wrote Suricata and Snort signatures for the Layer 4 anomalies, the operators began targeting edge proxies. They wrap the magic packet in a standard HTTPS POST and rely on the SSL offloading common in telecom environments. That may let the trigger reach the infected node without tripping conventional deep packet inspection.

The Rekoobe-based BPF backdoor takes a different angle. It intercepts TCP, UDP and SCTP IPv4 traffic and UDP IPv6 traffic where the source and destination ports are both 25, and it names its processes after SpamSniper components.

AVERAT: a backdoor that talks SMTP

AVERAT is a modular implant that uses SMTP for command and control, which helps it blend in with mail traffic. Here is how the reported chain works:

1. An ELF dropper sits in the ShareTech appliance’s /addpkg/sbin/ add-on package directory.
2. It derives an encryption key from the string “ShareTech” and uses it to decrypt a shell script.
3. The script stages and runs two binaries: ntpdate (the dropper itself) and udevds (the AVERAT payload).
4. Both files are deleted 10 seconds later.

AVERAT polls its C2 server (mx.zxopfds[.]com) over TCP port 25 every 600 to 699 seconds. The server and interval come from an encrypted configuration.

The command set is broad. It covers directory listing, file download with resume support, chunked upload, recursive deletion, process enumeration and termination, and rebooting the appliance. It can also open up to 10 concurrent interactive shell sessions and open a proxy or port-forward channel through the appliance. A command code of 1010 loads or unloads a shared object module, so the implant can be extended later.

Rapid7 says the C2 infrastructure matches the device-class profile typically associated with an Operational Relay Box (ORB) network. It found no evidence that it belongs to a known ORB such as LapDogs, SPACEHOP or FLORAHOX.

Why email gateways

The article ties this to a broader trend: threat actors targeting the privileged position of secure email gateways for intelligence collection. It cites the 2023 case of UNC4841, a China-nexus actor that exploited two vulnerabilities in Barracuda Email Security Gateway appliances (CVE-2023-2868 and CVE-2023-7102) to deliver persistent backdoors.

My take

This section is my analysis, not something the sources state.

The lesson I take from this is that names and ports are weak evidence of anything. A process called udevds or a PID file that matches a security product tells you only what the attacker wants you to think. If your hunting relies on spotting the odd one out by eye, this tradecraft is built to beat you.

The SMTP angle bothers me most. Many networks treat port 25 as a known quantity on mail servers and as background noise elsewhere. An appliance that sits on the edge and legitimately speaks SMTP is the ideal place to hide a beacon. The same goes for passive BPF implants, which don’t show up in a port scan because they don’t listen in the usual sense.

The BPFDoor story also shows a familiar cycle. Defenders publish signatures, and operators change the delivery method. If your detection for this family is one network signature, assume it is already out of date.

Practical takeaways

The article relays Rapid7’s recommendations. I’ve added a few notes on how I would apply them.

• Review raw packet sockets and BPF filters on Linux systems that have no reason to capture packets. A web or mail appliance with an attached BPF filter deserves an explanation.
• Audit outbound TCP port 25 from processes that are not mail services. Build the baseline first, then alert on deviations. On appliances, check which binary is making the connection, not just which host.
• Scan for processes posing as common daemons. Compare process names against their expected paths, parents and package ownership. A name match alone proves nothing.
• Restrict management access to routers, DVRs and other edge appliances. These devices often have weak logging and no endpoint agent, so limiting who can reach them is one of your few strong controls.

I’d add two more from my own experience. First, check the add-on package directories on your appliances (like /addpkg/sbin/ on ShareTech) and compare them to a known-good state. Second, if you run telecom or edge infrastructure in the affected regions, ask your vendors which of their product names and conventions are being spoofed, so you know what a fake looks like.

None of this is flashy. It is baselining, ownership checks and access control on devices that usually get neither. But that’s where this campaign is working, and it’s where I’d start looking.

Sources

• Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan — The Hacker News, 2026-10-06