BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics

Gbhackers •Mayura Kathir • April 7, 2026

Seven new BPFDoor variants that push Linux backdoor tradecraft deep into the kernel, making them harder to spot in large telecom networks. These implants use Berkeley Packet Filters (BPF) to quietly inspect traffic inside the operating system kernel, waiting for a “magic packet” that activates a hidden shell. Once triggered, the backdoor blends into normal […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New BPFDoor Malware Variants Target Telecom Networks Seven new variants of the BPFDoor malware have been identified, enhancing stealth in compromising major telecommunication networks. These variants utilize stateless command-and-control (C2) routing and employ techniques such as HTTP traffic concealment and ICMP tunneling to evade detection. The most notable variants include httpShell, which hides C2 within HTTP traffic, and icmpShell, which creates interactive shells while bypassing firewall rules. Other variants, such as the 'H' variant, utilize NTP-themed domain resolution for encrypted session establishment. Organizations are advised to monitor for unusual BPF filters and structural anomalies in network traffic to prevent potential breaches. The findings were reported by Rapid7 and highlight the growing sophistication of malware targeting critical infrastructure. 2 sources 68

Extracted Entities

BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)