BPFDoor, Rekoobe and AVERAT: Linux backdoors hiding in email
Three Linux backdoors hit telcos and network appliances in South Korea and Taiwan, disguised as SMTP traffic. Technical details and what to do right now.
On 2 October 2026 Rapid7 published research on three Linux backdoor families used against telecom operators and network appliances in South Korea and Taiwan: a new BPFDoor variant, a BPF-based build of Rekoobe and a new implant the researchers call AVERAT.
The common thread is disguise. Processes take the names of legitimate components of the compromised devices, and command traffic goes over port 25, the mail port. On a mail security gateway, whose job is to send and receive email, it is very hard to tell apart from normal work.
What happened
According to the research, covered by Infosecurity Magazine, Dark Reading, The Hacker News and Help Net Security:
- in South Korea, the new BPFDoor variant and the BPF-filtered Rekoobe build were observed;
- in Taiwan, a dropper and six builds of AVERAT, deployed on network appliances.
Rapid7 has not attributed the campaigns to a specific group. The infrastructure used by AVERAT matches the profile of China-nexus relay networks (operational relay box, ORB) described in an April 2026 advisory by CISA and partners, but it does not overlap with any known ORB network: attribution is still ongoing. The sources do not name the victims.
Technical details
BPFDoor has worried telecom security teams for years. It attaches a BPF (Berkeley Packet Filter) filter to a raw socket and stays silent, with no listening port and no outbound beaconing, until it receives a “magic packet”. The South Korean variant uses the process names of SpamSniper, a Korean anti-spam product; another sample instead takes the names of processes on Oracle-based telecom subscriber management platforms. Rapid7 also describes a BPFDoor controller that wraps the trigger packet in HTTPS POST requests, so the signal can pass through edge proxies and evade conventional packet inspection.
BPF Rekoobe waits for traffic where both source and destination ports are 25, and it too uses the names of SpamSniper components. According to Rapid7, firewall rules that allow mail relay between servers let the trigger packet reach the implant before any stateful inspection.
AVERAT does the opposite: it does not wait, it connects. It opens an outbound connection on TCP port 25, speaks SMTP (sends EHLO and requests STARTTLS) and only then starts its own encrypted session. In the flow records of a mail gateway this connection is indistinguishable from legitimate traffic. It checks in every 600–699 seconds and accepts commands to transfer files, kill processes, open up to ten concurrent shells and create proxy or port-forwarding channels.
Relays on third-party devices: three AVERAT builds contact hardcoded addresses belonging to compromised devices in Taiwan, unrelated to the targets: a Synology NAS, an obsolete small-business appliance and a Dahua video recorder. All three ran the same PPTP VPN service, which Rapid7 believes the operators installed, also giving them a way into each owner’s network.
Public indicators: the articles reviewed do not include hashes or addresses; for indicators, refer to Rapid7’s original research.
MITRE ATT&CK (mapping based on the reported facts): T1205.002 (Traffic Signaling: Socket Filters), T1036.005 (Masquerading: Match Legitimate Name or Location), T1071.003 (Application Layer Protocol: Mail Protocols), T1573 (Encrypted Channel), T1059.004 (Unix Shell), T1105 (Ingress Tool Transfer), T1090 (Proxy), T1584.008 (Compromise Infrastructure: Network Devices).
Impact for European and Italian companies
The sources do not mention victims in Europe. The pattern, however, applies everywhere: mail gateways, VPNs and firewalls are exposed to the internet and have privileged access to the network. As Rapid7’s Christiaan Beek told Help Net Security, they are often closed, vendor-managed boxes that cannot run EDR: an ideal foothold for staying a long time.
For telecom operators the risk goes beyond data theft: from the network core an attacker can observe subscriber identifiers, signalling, authentication exchanges and communications metadata. Under NIS2, providers of public electronic communications networks and services are part of digital infrastructure, one of the sectors of high criticality, and Article 21 requires risk-management measures that include supply chain security. An appliance whose behaviour you cannot verify is a risk to manage, not just to hand over to the vendor.
Organisations that are not operators are involved too: AVERAT’s relays were NAS units, video recorders and old small-business appliances, devices that are common in Italian SMEs as well. A forgotten device with open management access can become a node in someone else’s infrastructure.
What to do right now
- Look for unexpected raw sockets and BPF filters on Linux servers and appliances where you have a shell:
ss -0 -p(or/proc/net/packet) lists packet sockets and the processes using them. Few processes have a reason to open them, such as capture tools or DHCP clients: check every other one. - Look for processes whose executable has been deleted, which show a
(deleted)suffix in/proc: for examplels -l /proc/*/exe 2>/dev/null | grep deleted. - Check who uses outbound port 25: only the mail service should (
ss -tnp state established '( dport = :25 )'). On mail gateways flow records are not enough: look at which process opens the connection. - Verify process names: a process named after a common daemon or a product component but running from an unusual path needs checking.
- Tighten SMTP relay: restrict firewall rules allowing port 25 between servers to the mail peers that actually need it.
- Lock down management access to routers, NAS units, video recorders and edge appliances: no internet exposure, only from management networks. Disable PPTP and make sure there are no VPN services you did not configure yourself.
- Ask the vendors of closed appliances how to verify their integrity, if you cannot do it yourself.
- Report honestly: Beek suggests telling the board what was searched, what cannot be seen and who will close that gap, and by when. “No evidence” does not mean “we are clean”.
How ARXDOME helps
On Linux servers where it is installed, the ARX Sentry agent collects logs, the inventory of processes and ports and file changes in the chosen folders, and brings them into the SOC pages. ARX Watch finds devices without a probe on the network, such as NAS units and video recorders, and alerts you when a new one appears. ARX Expose shows open ports and recognised products from the outside, including management interfaces exposed by mistake. On closed appliances the limit Beek mentions remains: visibility depends on what the device allows.
Last updated:
