BPFdoor in Telecom Networks: Sleeper Cells in the Backbone
2026-03-26T19:23:53Z•2d1f4303ca48165360e995a278f787600d6390367e91a06ea2a0b1bccc0833d6
BPFdoorBSI C5Citrix NetScalerIoTMetasploitRed MenshenSAML IDPcellular-IoTcomplianceeBPFespionagetelecomtelecommunications-infrastructureweb-application-security
What happened
Rapid7 published multiple security updates and research in late March 2026. Key findings include Rapid7 Labs’ investigation of a China-nexus APT dubbed Red Menshen deploying highly stealthy BPF/eBPF-based “BPFdoor” sleeper cells inside telecommunications infrastructure to enable long-term espionage and access to sensitive communications. Rapid7 also released IoT research demonstrating how cellular modem components and inter-chip interfaces (USB/UART) can be weaponized to pivot from devices into cloud/back-end systems. A critical Citrix NetScaler ADC/Gateway vulnerability (CVE-2026-3055, CVSS 9
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 2d1f4303ca48165360e995a278f787600d6390367e91a06ea2a0b1bccc0833d6
- Enrichment time
- 2026-03-26T19:23:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.