New Linux Backdoors Target Telecom Appliances in South Korea and Taiwan

InfoSecurity Magazine reported that security firm Rapid7 uncovered new Linux malware variants targeting telecommunications and network-edge appliances in South Korea and Taiwan. The research published on October 2 details newly observed builds of BPFDoor, BPF Rekoobe, and an implant named AVERAT. [1]

According to InfoSecurity Magazine, the newly identified backdoors hide their presence on compromised devices by disguising network traffic as legitimate email and spoofing process names. The AVERAT implant establishes outbound connections over Transmission Control Protocol port 25 and utilizes Simple Mail Transfer Protocol commands, sending an EHLO request and initiating STARTTLS before executing its encrypted payload. [1]

Rapid7 observed the BPFDoor variant and BPF Rekoobe build deployed against targets in South Korea, as reported by InfoSecurity Magazine. In Taiwan, attackers deployed a dropper alongside six distinct builds of the AVERAT implant against network-edge hardware. [1]

Linux operating systems are generally regarded as well protected against computer viruses, though they remain vulnerable to specialized malware, as noted in general background documentation. Email filtering systems typically process automatic SMTP server messages to screen incoming and outgoing traffic. [2][3]