New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

Rapid7 Labs published a whitepaper identifying seven new BPFDoor variants — a stealthy kernel-level backdoor that leverages Berkeley Packet Filters (BPF) to inspect traffic inside the OS kernel and establish persistence in telecom infrastructure. Two primary variants, “httpShell” and “icmpShell,” use stateless C2 routing, ICMP relay, and a “magic packet” delivered via stateless protocols to create nearly undetectable command-and-control. The research analyzed ~300 samples, attributes activity to a China-nexus actor (Red Menshen), and provides detection/response guidance. The same Rapid7 feed包含