Stealthy Nation-State BPFDoor

BPFDoor is a Linux/Unix backdoor that allows threat actors to remotely connect to a Linux shell to gain complete access to a compromised device. It supports multiple protocols for communicating with a command & control server (C2) including TCP, UDP, and ICMP. It notably utilizes Berkeley Packet Filters (BPF) along with several other techniques to achieve these goals. BPF is a hooking function that allows a user-space program to attach a network filter onto any socket, and then allows or disallows certain types of data to come through that socket.

REFERENCE: https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor

TAGS: BPFDoor, Linux, backdoor, BPF, Red Menshen

INDUSTRIES: Telecommunications, Logistics, Education, Government

TARGETED COUNTRIES: Myanmar, Viet Nam, India, Turkey, Hong Kong, Korea, Republic of

MALWARE FAMILY: BPFDoor

ATT&CK IDS: T1008 - Fallback Channels, T1036 - Masquerading, T1059 - Command and Scripting Interpreter, T1070 - Indicator Removal on Host, T1095 - Non-Application Layer Protocol, T1106 - Native API, T1548 - Abuse Elevation Control Mechanism

Read More:

https://otx.alienvault.com/pulse/62e8e78bedb06157297a08b6