Malware News New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

Khushal

Khushal

Level 14
Thread author
Verified
Top Poster
Well-known
Apr 4, 2024
697
4,125
1,269
Content source
https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/
Advanced persistent threats (APTs) are constantly and consistently changing tactics as network defenders plug holes in defenses. Static indicators of compromise (IoCs) for the BPFDoor have been widely deployed, forcing threat actors to get creative in their use of this particular strain of malware. What they came up with is ingenious.

New research from Rapid7 Labs has uncovered undocumented features leading to the discovery of 7 new BPFDoor variants: a stealthy kernel-level backdoor that uses Berkeley Packet Filters (BPFs) to inspect traffic from right inside the operating system kernel. This essentially creates a silent trapdoor that can be activated by a threat actor once a “magic packet” is tunneled via stateless protocols. The malware is then able to perfectly blend into the target environment, establishing nearly undetectable persistence in global telecom infrastructure.

Our latest research continues the narrative established in our blog BPFdoor in Telecom Networks: Sleeper Cells in the Backbone. It involves the analysis of nearly 300 samples and identifies two primary new variants: httpShell and icmpShell. These variants represent a significant leap in operational security, utilizing stateless C2 routing and ICMP relay to bypass multi-million dollar security stacks.
www.rapid7.com

New Whitepaper: Stealthy BPFDoor Variants are a Needle That Looks Like Hay

New research from Rapid7 Labs, involving the analysis of nearly 300 samples, has uncovered 7 new BPFDoor variants acting as a silent trapdoor. Activation allows malware to perfectly blend into the target environment, establishing nearly undetectable persistence in global telecom infrastructure...
www.rapid7.com
Click to expand...
 
  • Like
Reactions: Sampei.Nihira, Zero Knowledge, Andy Ful and 4 others
Rapid7’s findings are interesting, but a few parts of that quoted summary need to be read carefully.

What stands out technically

  • BPFDoor is not “new,” but the reported command-and-control variations and undocumented behaviors appear to be the main value of this research.
  • Using BPF-based packet inspection for covert activation is one of the reasons BPFDoor has drawn attention for years. It can watch traffic in a very low-noise way and avoid exposing a normal listening service.
  • The mention of stateless protocols and “magic packets” is important because that reduces obvious network indicators. Defenders relying too heavily on static IoCs can miss that kind of activity.
  • If the newly discussed variants really use HTTP- or ICMP-based relay logic in the way Rapid7 describes, that would make detection harder in environments where those protocols are common and noisy.

One point worth clarifying

The phrase “kernel-level backdoor” can be misleading if readers interpret it as a kernel module or rootkit in every case.

BPF gives software a way to filter or inspect packets very close to the network stack, but that does not automatically mean the malware itself is a full kernel-mode implant. In general, BPFDoor has been described as a user-space backdoor that abuses BPF for stealthy packet filtering. The exact implementation details matter here, so it is better to rely on the whitepaper wording rather than assume every sample is a kernel implant.

Why defenders should care

  • Static IoCs alone are not enough for malware families like this.
  • Behavioral detection becomes more important than hash- or IP-based blocking.
  • Long-dwell threats in telecom or ISP environments are especially serious because they can provide broad visibility and persistence.
  • ICMP and unusual raw socket behavior deserve more attention than many organizations currently give them.

Practical defensive takeaways

  • Review for anomalous raw socket usage, packet capture/filter behavior, and unexpected long-running processes with network capabilities.
  • Hunt for persistence mechanisms outside the usual web shell or service-install patterns.
  • Inspect east-west and management-network traffic, not only internet-facing segments.
  • Use EDR, network telemetry, and host-based logs together. BPFDoor-style activity is easier to spot through correlation than through one control alone.
  • Validate detections against the vendor’s technical report rather than relying on secondary summaries.

Bottom line

The main lesson is not just “7 new variants exist,” but that stealthy packet-triggered backdoors continue to evolve faster than static detection logic. Rapid7’s report is useful because it pushes defenders toward behavioral hunting and protocol-aware analysis instead of depending only on traditional IoCs.
 
  • Like
Reactions: Halp2001
Andy Ful said:
It is worth mentioning that BPFDoor malware depends on the Berkeley Packet Filter (BPF), which is not used in Windows. The samples noted in the article were for Linux.
Click to expand...
Yeah but my expertise does not end at windows malware, it just begins. Also I don't think this forum is only reserved for Windows malware discussions. The recent axios npm compromise reiterates the fact that cross-platform malware spread is a not just a thing of future (even though the linux malware was only persistent till reboot).
 
  • Like
Reactions: piquiteco, Andy Ful and Sampei.Nihira

You may also like...