Back Cybersecuritynews

Hackers Plant Stealthy BPFdoor Backdoors in Telecom Networks for Long

Cybersecuritynews •Guru Baran • March 26, 2026

A months-long investigation by Rapid7 Labs has exposed a sophisticated, state- espionage campaign by the China-nexus threat actor Red Menshen, which has embedded some of the most covert digital sleeper cells ever documented inside global telecommunications infrastructure. Released on March 26, 2026, the findings reveal a deliberate shift from opportunistic hacking to long-term pre-positioning within […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Red Menshen APT Uses BPFdoor for Long-Term Espionage in Telecom Networks A China-linked threat actor known as Red Menshen has been conducting a long-term espionage campaign targeting global telecommunications networks using a stealthy Linux kernel backdoor called BPFdoor. This malware operates at the kernel level, allowing it to passively inspect network traffic and activate only upon receiving specially crafted packets, thus avoiding detection by traditional security measures. Rapid7 Labs uncovered this campaign, which has been ongoing since at least 2021, indicating a shift from opportunistic attacks to pre-positioning within critical infrastructure. The group has successfully infiltrated telecom systems across multiple regions, including Europe and Asia, raising significant concerns about national security. The stealthy nature of BPFdoor complicates detection efforts, as it blends in with normal network operations and does not expose typical command-and-control indicators. Current efforts are underway to develop detection tools to identify these implants in affected systems. 16 sources 78

Extracted Entities

Hackers Plant Stealthy BPFdoor Backdoors in Telecom Networks for Long

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Industries (1)

Malware (1)