Cybersecurity
Rapid7 finds Linux backdoors impersonating email tools
Rapid7 said Linux backdoors aimed at telecom and network devices in South Korea and Taiwan reused email-security names, BPF techniques and SMTP traffic to hide their activity.
- Rapid7 said it found Linux backdoors aimed at telecom and network devices in South Korea and Taiwan.
- The samples included a new BPFDoor variant, a BPF Rekoobe build and a previously unreported implant called AVERAT.
- Rapid7 said some BPFDoor samples impersonated SpamSniper, while another sample used a process name meant to resemble database-related naming.
- AVERAT used SMTP for command-and-control, and its dropper was staged from a ShareTech appliance directory.
- Rapid7 recommended watching for raw packet sockets, BPF filters, outbound TCP port 25 traffic from non-mail processes and spoofed daemons.
Rapid7 said it had found Linux backdoors aimed at telecom and network devices in South Korea and Taiwan. It said the malware copied the names of email-security products and ordinary system processes to blend into target environments.
The set included a new BPFDoor variant, a BPF Rekoobe build and a previously unreported implant called AVERAT. Rapid7 said the BPFDoor samples imitated SpamSniper naming, and one sample used a process name meant to resemble database-related conventions.
Rapid7 said the BPFDoor code used Berkeley Packet Filter functions to watch incoming traffic and activate only when it saw a trigger packet. It also said the operators had wrapped that trigger in HTTPS POST requests, and that the sample could open a TinyShell session for commands and file transfer.
The AVERAT implant was delivered by an ELF dropper found in a ShareTech appliance package directory and used SMTP for command-and-control. Rapid7 said it contacted mx.zxopfds[.]com every 600 to 699 seconds and could run file, process, shell, proxy and reboot commands.
Rapid7 advised checking for unusual raw packet sockets, BPF filters, outbound port 25 traffic and processes posing as common daemons. It also recommended restricting management access to routers, DVRs and other edge appliances.
Named in this story
Companies
- Rapid7
- identified the backdoors and described their behaviour
- Jiran Group
- said SpamSniper was marketed as a leading email security solution
Products and systems
- SpamSniper
- an email security product whose name was impersonated
- ShareTech
- an appliance whose directory held the dropper
- BPFDoor
- a Linux backdoor family with new variants in the report
- BPF Rekoobe
- a Linux backdoor build used against South Korean targets
- AVERAT
- a previously unreported Linux implant delivered by a dropper
- TinyShell
- a session tool launched by the BPFDoor sample
- Berkeley Packet Filter (BPF)
- the packet-filtering feature abused by BPFDoor
Places
- South Korea
- a target country named in the report
- Taiwan
- a target country named in the report
How the source tells it
The piece was a technical security report, with steady emphasis on concealment and operator adaptation rather than overt alarm.
- stealth and concealment repeated focus on disguising traffic, process names and product identities
- operational urgency claims of active retooling and a closing list of defensive checks