Back Securityaffairs.Co

China

Securityaffairs.Co •Pierluigi Paganini • March 27, 2026

China-linked Red Menshen APT group used stealthy BPFDoor implants in telecom networks to spy on government targets. Rapid7 Labs uncovered a China-linked threat group known as Red Menshen has been running a long-term espionage campaign by infiltrating telecom networks, mainly in the Middle East and Asia. Active since at least 2021, the group uses highly […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks A China-linked threat actor known as Red Menshen has been conducting a long-term espionage campaign targeting global telecommunications networks using a stealthy Linux kernel backdoor called BPFdoor. This malware operates at the kernel level, allowing it to passively inspect network traffic and activate only upon receiving specially crafted packets, thus avoiding detection by traditional security measures. Rapid7 Labs uncovered this campaign, which has been ongoing since at least 2021, indicating a shift from opportunistic attacks to pre-positioning within critical infrastructure. The group has successfully infiltrated telecom systems across multiple regions, including Europe and Asia, raising significant concerns about national security. The stealthy nature of BPFdoor complicates detection efforts, as it blends in with normal network operations and does not expose typical command-and-control indicators. Current efforts are underway to develop detection tools to identify these implants in affected systems. 16 sources 78

Extracted Entities

China

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)