China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
2026-03-26T19:24:12Z•123e3409b5c9994c81486b81f7df755670944dc74ae6006edcae9d83621ee553
Anthropic ClaudeBPFDoorBYOVD/Huawei driverCVE-2026-3055CVE-2026-4368Citrix NetScalerCoruna iOS/Operation TriangulationEarth BluecrowGitHub Actions compromiseGlassWormOAuth abuseRed MenshenScreenConnectSolana dead dropsTeamPCPWebRTC skimmerdevice code phishingespionagelitellm backdoormalicious npm packagesmalvertisingpayment skimmersupply chain compromisetelecom infiltrationzero-click XSS
What happened
The feed highlights a high-impact China-linked espionage campaign (Red Menshen/Earth Bluecrow) that has implanted stealthy BPFDoor backdoors inside telecom networks to maintain long-term access to government environments. Other notable items include critical Citrix NetScaler fixes (CVE-2026-3055, CVE-2026-4368), multiple supply-chain and CI/CD compromises (TeamPCP backdooring litellm and hijacking GitHub Actions), widespread device-code OAuth phishing hitting 340+ Microsoft 365 orgs, a zero-click XSS/prompt-injection bug in Anthropic's Claude Chrome extension, a WebRTC-based payment skimmer ev
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 123e3409b5c9994c81486b81f7df755670944dc74ae6006edcae9d83621ee553
- Enrichment time
- 2026-03-26T19:24:12Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.