A sophisticated and sustained intrusion campaign has been identified operating within telecommunications infrastructure across the Middle East and Asia, with activity dating back to at least 2021. Security researchers at Rapid7 have attributed the operation to a threat cluster known under multiple tracking designations — Red Menshen, Earth Bluecrow, DecisiveArchitect, and Red Dev 18 — a China-nexus actor with a documented history of targeting regional telecom providers.
Rapid7 characterized the implants discovered within these networks as among the most covert access mechanisms ever observed in telecommunications environments, describing them as functioning analogously to dormant digital sleeper cells embedded within critical infrastructure.
Initial access and post-exploitation tooling
Entry into victim environments is achieved by exploiting vulnerabilities in internet-facing edge infrastructure. Affected platforms have included VPN appliances, firewalls, and web-exposed services associated with vendors such as Ivanti, Cisco, Juniper Networks, Fortinet, VMware, Palo Alto Networks, and Apache Struts. Once a foothold is established, the threat actor deploys Linux-compatible post-exploitation frameworks, most notably CrossC2, alongside secondary tools including Sliver, TinyShell (a Unix backdoor), keyloggers, and brute-force utilities — all oriented toward credential harvesting and lateral movement within compromised environments.
BPFDoor: the operational core
Central to this campaign is BPFDoor, a Linux backdoor that fundamentally diverges from conventional malware design. Rather than exposing listening network ports or maintaining visible command-and-control channels, BPFDoor abuses Berkeley Packet Filter functionality to inspect incoming network traffic directly at the kernel level. The implant remains entirely passive until it receives a specially crafted trigger packet — a sequence that, when matched, causes the implant to spawn a remote shell. In the absence of such a packet, no persistent listener or outbound beacon is present, rendering the implant effectively invisible to conventional network monitoring.
BPFDoor is architecturally divided into two components. The first is the passive backdoor deployed on a compromised host, which installs a BPF filter and awaits the trigger. The second is an operator-side controller responsible for crafting and sending the activation packets. Notably, the controller is designed to run from within the victim’s own environment, where it can masquerade as legitimate system processes. In this configuration it can trigger additional implants across internal hosts or open local listeners to receive shell connections, enabling controlled lateral movement between compromised systems without generating anomalous external traffic.
Certain BPFDoor samples have been found to support the Stream Control Transmission Protocol, a telecom-native protocol whose inclusion suggests the threat actor may be positioned to monitor subscriber behavior, derive location information, or track individuals of operational interest.
An evolved variant and expanding stealth mechanisms
Researchers identified a previously undocumented BPFDoor variant incorporating significant architectural changes designed to improve evasion within modern enterprise and telecommunications environments. The most notable modification involves concealing the activation trigger within ostensibly legitimate HTTPS traffic. The variant introduces a novel parsing mechanism in which the marker string “9999” must appear at a fixed byte offset within a request payload. This approach allows the magic packet to be carried inside HTTPS traffic without disturbing the positional arrangement of surrounding data, and allows the implant to check deterministically for the marker at a known offset — interpreting its presence as an activation command. The result is an activation mechanism that is structurally indistinguishable from ordinary encrypted web traffic.
The same variant also introduces a lightweight inter-host communication mechanism using the Internet Control Message Protocol, enabling coordination between infected systems through a channel typically associated with routine network diagnostics.
Strategic implications for telecommunications environments
The broader significance of this campaign extends beyond the technical capabilities of individual tools. Rapid7 assessed that BPFDoor, in the context of telecommunications networks, functions less as a conventional backdoor and more as a persistent access layer embedded within the network backbone itself — one capable of providing long-term, low-noise visibility into critical operational traffic.
Telecommunications infrastructure presents a uniquely permissive environment for this class of threat. The convergence of bare-metal systems, virtualization layers, high-performance appliances, and containerized 4G/5G core components creates an expansive and heterogeneous attack surface. Implants that blend into hardware services or container runtimes can evade traditional endpoint security controls and persist undetected for extended periods. The campaign reflects a broader trend in adversary tradecraft: rather than relying on user-space malware, threat actors are increasingly targeting the kernel layer and infrastructure platforms themselves, positioning implants deeper within the computing stack where detection is substantially more difficult.
FileDNA and ObtainDNA redefine file security by operating at the internal composition level of each file. Rather than relying on conventional antivirus methods that match known signatures and proceed, our platforms perform deep structural inspection—analyzing file architecture, removing embedded or obfuscated threats, and rebuilding a sanitized version before it is allowed to pass through.
Within modern environments, files originate from a wide range of ingress points, including email systems, shared repositories, automated data pipelines, and external transfers. Each of these vectors introduces the risk of concealed malware, hidden payloads, or manipulated metadata. FileDNA and ObtainDNA adopt a zero-trust stance toward all incoming files, enforcing comprehensive inspection and sanitization irrespective of origin.
The outcome extends beyond simple threat detection. Our technologies deliver fully reconstructed, verified-safe files that integrate directly into operational workflows without interruption. The process introduces no user friction while establishing a robust, underlying control layer that isolates critical systems from file-borne threats.