Back Gbhackers

Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access

Gbhackers •Divya • March 27, 2026

A China-nexus threat actor known as Red Menshen is planting stealthy backdoors deep inside global telecommunications networks. According to a recent investigation by Rapid7 Labs, this long-term espionage campaign utilises a highly evasive Linux kernel malware called BPFdoor. Instead of launching noisy, disruptive attacks, these hackers are building dormant sleeper cells in the telecom backbone. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks A China-linked threat actor known as Red Menshen has been conducting a long-term espionage campaign targeting global telecommunications networks using a stealthy Linux kernel backdoor called BPFdoor. This malware operates at the kernel level, allowing it to passively inspect network traffic and activate only upon receiving specially crafted packets, thus avoiding detection by traditional security measures. Rapid7 Labs uncovered this campaign, which has been ongoing since at least 2021, indicating a shift from opportunistic attacks to pre-positioning within critical infrastructure. The group has successfully infiltrated telecom systems across multiple regions, including Europe and Asia, raising significant concerns about national security. The stealthy nature of BPFdoor complicates detection efforts, as it blends in with normal network operations and does not expose typical command-and-control indicators. Current efforts are underway to develop detection tools to identify these implants in affected systems. 16 sources 78

Extracted Entities

Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access

The full story

Extracted Entities

Attack Types (1)

Industries (1)

Malware (1)

Platforms (1)