A sophisticated China-nexus threat actor has embedded digital sleeper cells into the networks of telecom firms in multiple countries, according to a report released Thursday from cybersecurity firm Rapid7.
The adversary, tracked as Red Menshen, has used a stealthy, Linux-based implant called BPFdoor that is designed to function within the operating system kernel.
The goal is to run an espionage campaign against critical industry segments and government agencies, maintaining a long-term presence inside these networks, Rapid7 researchers said. There are similarities to campaigns previously launched by other China-nexus actors, including Volt Typhoon and Salt Typhoon, but the mechanisms have evolved and the strategic objectives of these attacks have a longer tail.
“Based on what we’ve observed, the strongest evidence points to intelligence collection and long-term access, not immediate disruption,” said Christiaan Beek, vice president of cyber intelligence at Rapid7. “In telecom networks, that can mean visibility into signaling systems, subscriber-related data, communications metadata, and other high-value infrastructure functions.”
The backdoor is a malicious version of Berkeley Packet Filter that operates like a trapdoor built into the operating system.
The BPFdoor functionality allows the attackers to operate at a stealth mode that avoids using visible command-and-control channels and does not expose listening ports, according to Rapid7. This enables the threat actor to maintain a long-term presence inside an organization without triggering most detection systems.
The threat activity follows prior China-nexus activity linked to Volt Typhoon, which involved hackers gaining persistent access onto U.S. networks in preparation for a diversionary attack if the People’s Republic of China engaged in military actions against Taiwan.
Salt Typhoon, a separate China-nexus actor, was capable of embeding itself inside the networks of major U.S. telecom firms for years. The group was able to gather data about communications of telecom customers, with a focus on high-profile political and military figures.
Rapid7 said it has worked closely with government partners and various national Community Emergency Response Teams to share findings on the research.
Security teams need to focus on improving visibility beyond the traditional perimeter, Beek said.
“Organizations should hunt for unusual raw socket activity, anonymous packet-filtering behavior and service masquerading on critical Linux systems,” Beek told Cybersecurity Dive.
Telecom firms and other critical infrastructure providers also need to focus on exposed edge devices, containerized environments and signaling-related traffic, Beek added.
