Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
About this summary. This is a short excerpt from the description that Infosecurity Magazine published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.infosecurity-magazine.com/news/smtp-linux-backdoors-network-edge/
Source attribution: headline and facts are from Infosecurity Magazine (infosecurity-magazine.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate…
SMTP is the key: BPFDoor and AVERAT hitting the network edge
OverviewRapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed…
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our…
What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview…
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…