What the BPFDoor backdoor tells us about attacks on the network edge

A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk. Beek also covers how CISOs should report “no findings” to the board and which simple Linux checks teams can run this week.

For readers who haven’t followed this malware family, what is BPFDoor, and why has it worried telecom security teams for years? What makes a backdoor that sits silently and waits for a special “magic packet” so hard to find?

BPFDoor is a Linux backdoor designed to stay silent until it receives a specific “magic packet.” Unlike traditional malware, it doesn’t need to beacon constantly or open an obvious listening port, which would draw attention.

That makes it difficult to detect because silence is part of the design. No outbound traffic and no alerts do not mean the system is clean.
It also keeps changing. Once defenders learned to spot one way of sending the secret signal, the operators found another way to hide it. In the first research from Rapid7 Intelligence, a new unified engine shifting threat defense from reactive to proactive, researchers found new versions that even masquerade as regional software, like a Korean anti-spam product, to blend into the system.

Modern telecom networks are layered ecosystems composed of routing systems, subscriber management platforms, authentication services, billing systems, roaming databases, and lawful intercept capabilities.

Persistent access within these environments enables far more than a conventional data breach. An adversary positioned inside the telecom core may gain visibility into subscriber identifiers, signaling flows, authentication exchanges, mobility events, and communications metadata. In the most concerning scenarios, this level of access could support long-term intelligence collection, large-scale subscriber tracking, and monitoring of sensitive communications involving high-value geopolitical targets.

Telecommunications networks sit at the intersection of identity, mobility, and global connectivity. Compromise at this layer carries national and international implications.

Most people picture telecom attacks hitting core routers or subscriber databases. Why are these operators going after devices at the network edge, such as mail security gateways and other appliances that sit between an organization and the internet?

Because the edge combines Internet exposure, trusted access and poor visibility.

A compromised mail gateway, VPN appliance or firewall already communicates with the Internet, so malicious traffic can blend into normal behavior. Attackers are effectively hiding inside infrastructure we already expect to be noisy.

Worse, these appliances are closed, vendor-managed boxes that typically can’t run endpoint detection and response (EDR) or other endpoint agents. A foothold there is well placed for long-term access, particularly in telecom environments.

Many network appliances can’t run endpoint security agents, and some vendor support contracts restrict what customers can install. How common is this blind spot in telecom environments, and how should a CISO push vendors to close it?

Compromising a telecom provider is not about the telecom provider itself; we need to realize that capabilities a threat actor would have after doing so, ranging from tracking people to disrupting the mobile traffic, could impact an entire nation.

For a CISO, this is a risk ownership problem. If an appliance can sit between your organization and the internet, but you cannot independently verify what it is doing, then you are effectively outsourcing trust without outsourcing the accountability.

How should a security leader brief a board on a threat designed to set off no alarms? What does honest reporting look like when you’ve searched and found nothing?

A good brief has three parts: what we searched, what we could not see, and who owns closing that gap by when. Boards handle uncertainty well when it comes with an owner and a date.

Never say, “We checked, and we’re clean.” Say: “We searched the systems where we have sufficient visibility and found no evidence of compromise. These are the areas where visibility remains limited.” That is much more honest. A green dashboard is not the same thing as proof. And realistically, this is one of the hardest things to detect. It is looking for a needle that looks and smells like hay in a gigantic haystack.

If a CISO at a carrier or large enterprise called you tomorrow, what would you have their team look for this week on Linux servers and appliances? Explain it in terms a board member could follow.

First, this is a very targeted and sophisticated attack that has been used against a specific amount of sectors and targets. Ask yourself whether you would be on that attacker’s target list. And secondly, look at the stealthy techniques BPFdoor uses and make sure that your outer fences are protected. These types of attacks start with a compromised account, or a vulnerability at the edge. That is where you can start.

From there, the checks are simpler than people expect, and they work on any Linux system where you have shell access or an agent. Look for processes whose executable has been deleted, which show a “(deleted)” suffix under /proc. Then look for raw packet sockets on systems that have no reason to capture traffic, and watch for outbound port 25 from anything that isn’t a mail service. Finally, check for unrestricted management access to edge devices so a stolen credential doesn’t hand over the keys.

Webinar: Closing the accountability gap in AI-assisted delivery