New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

Rapid7 Labs uncovered undocumented features that reveal seven new BPFDoor variants: a stealthy kernel‑level backdoor that uses Berkeley Packet Filters (BPF) to inspect traffic inside the OS kernel and establish near‑undetectable persistence in global telecommunications infrastructure. Variants include two primary strains—httpShell and icmpShell—that implement stateless C2 routing and ICMP relay, enabling activation via a tunneled “magic packet” over stateless protocols and allowing operators to bypass large security stacks. Research links activity to a China‑nexus actor (Red Menshen) and warns