BPFDoor

Description

BPFDoor is a Linux backdoor that uses Berkeley Packet Filter rules to sniff network traffic on compromised systems and remain invisible to connection based monitoring. It can activate when it sees a specific packet, open a shell for its operators, and sustain stealthy command and control communication on networks that researchers have linked to Chinese state sponsored actors. Its passive design lets it sit quietly on internet facing servers for long periods before its operators need it.

Stats

First seen

May 2022

Last seen

October 2026

Also known as

MITRE ATT&CK techniques

13 techniques across 3 tactics.

Alert name variants

Related families

References

• malpedia.caad.fkie.fraunhofer.de →
• attack.mitre.org →