AVERAT (Malware): news timeline & CVEs

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors impersonating SpamSniper and ShareTech target telecom appliances in South Korea and Taiwan.

Rapid7 reported Linux backdoors targeting telecom and network appliances in South Korea and Taiwan that disguise themselves as email-security products SpamSniper and ShareTech. New BPFDoor samples, linked to Red Menshen, impersonate SpamSniper PID files, activate on a BPF magic packet, and can receive that trigger inside HTTPS POST requests before opening a TinyShell session. A related Rekoobe-based BPF backdoor watches traffic on port 25. An ELF dropper on ShareTech appliances installs AVERAT, which polls mx.zxopfds[.]com over TCP port 25 and supports interactive shells, file transfer, process control, reboot, and loadable modules.

The Hacker NewsOct 6, 18:24 UTC · 2d agoMalware in the wild 3 sources

New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic

Rapid7 documents stealthy Linux backdoors—BPFDoor, Rekoobe, and new AVERAT implant—targeting telecom and network-edge appliances in South Korea and Taiwan.

Rapid7 research published October 2 details a newly observed BPFDoor variant and BPF Rekoobe build used against South Korean targets, plus a dropper and six AVERAT implant builds deployed on Taiwanese network-edge appliances. AVERAT beacons over TCP port 25 using SMTP EHLO and STARTTLS, making its traffic indistinguishable from legitimate mail on security gateways, and supports file transfers, process termination, up to ten concurrent shell sessions, and proxying. Implants report to hardcoded relays on compromised devices including a Synology NAS, an obsolete small-business appliance, and a Dahua video recorder running attacker-installed PPTP VPN, matching CISA ORB network device profiles. Attribution remains ongoing.

Infosecurity Magazineupdated Oct 6, 18:24 UTC · 2d agofirst Oct 5, 14:00 UTC · 3d agoMalware in the wild 3 sources

SMTP is the key: BPFDoor and AVERAT hitting the network edge

Rapid7 details BPFDoor and AVERAT Linux implants disguised as telecom-edge software in South Korea and Taiwan.

Rapid7 analyzed Linux samples built for telecom and network-edge devices, including a new BPFDoor variant, a BPF Rekoobe build seen on South Korean targets, a dropper, and six AVERAT builds deployed on Taiwanese appliances. A dropper stages payloads as ntpdate and udevds under /sbin, deletes the files while the processes keep running, and derives an encryption key from the string ShareTech. BPFDoor impersonates SpamSniper and common daemons, uses BPF socket filters, and a newer controller tunnels triggers in padded HTTPS POST requests while also using DNS, TCP, and SMTP. Telecommunications operators and nearby embedded CCTV and DVR systems are the main exposure.

Rapid7 Blogupdated Oct 6, 18:24 UTC · 2d agofirst Oct 2, 13:00 UTC · 6d agoMalware in the wild 3 sources2

AVERAT

Timeline3 articles

Appears with

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic

SMTP is the key: BPFDoor and AVERAT hitting the network edge