Rapid7 Labs Identifies State-Sponsored Sleeper Cells Embedded in Global ...

While RPD was down 1.93% , key peers like RDWR and ATEN showed gains (e.g., RDWR up 5.27% ), and sector momentum scanners did not flag a coordinated move. This points to stock-specific dynamics rather than a sector-wide shift.

Recent news—product enhancements, threat reports, and conference participation—has more often aligned with modest positive price reactions, with only one notable divergence.

Over the last months, Rapid7 has focused on platform enhancements, threat intelligence, and investor outreach. On Mar 19 , new Exposure Command cloud security capabilities coincided with a +1.94% move. The 2026 Global Threat Landscape Report on Mar 18 saw a smaller +0.16% reaction. Updates to the PACT Partner Program on Mar 17 aligned with a -1.9% decline, a divergence from otherwise generally positive responses to news. Conference attendance announcements in early March and late February saw gains between +1.52% and +2.45% . Today’s telecom espionage research continues the pattern of intelligence- and capability-focused disclosures.

This announcement highlights Rapid7 Labs’ research into long-term espionage access in global telecommunications infrastructure, including kernel-level backdoors and abuse of encrypted HTTPS traffic and SCTP -based signaling. The company released a free, open-source scanning script and integrated new detections into its offerings, extending themes from earlier threat reports and product enhancements in March 2026. Investors watching this story may focus on adoption of these capabilities, follow-on incident response demand, and how such research supports Rapid7’s positioning in managed cybersecurity operations.

AI-generated analysis. Not financial advice.

Research reveals long-term espionage access inside telecommunications infrastructure with implications for government communications and critical systems

BOSTON, March 26, 2026 (GLOBE NEWSWIRE) -- Rapid7 (NASDAQ: RPD ), a global leader in AI-powered managed cybersecurity operations, released findings from a months-long research investigation from Rapid7 Labs, “ Sleeper Cells in the Telecom Backbone ,” detailing a sustained espionage campaign conducted by a China-nexus threat actor, Red Menshen, with covert access inside global telecommunications infrastructure.

“If you have access to telecommunications infrastructure, you are not just inside one company, you are operating close to the communication layer of entire populations, which makes this type of access highly valuable and elevates detection to a national-level concern,” said Raj Samani, chief scientist at Rapid7. “The activity we are seeing continues to evolve in ways that improve stealth and persistence, and organizations should treat detection as the start of investigation, not the end of it.”

The research also identifies critical visibility gaps into persistence at the kernel and packet-filtering layers. Without insight into these areas, service masquerading and stealth activation techniques can remain undetected for extended periods. Organizations must have preemptive detection strategies that identify unusual service masquerading and stealth activation mechanisms before they can be leveraged for high-level intelligence collection.

“This is not traditional espionage, it is pre-positioning inside the infrastructure that nations depend on,” said Christiaan Beek, vice president of cyber intelligence at Rapid7. “We are seeing a persistent access model where attackers embed within core communications systems and maintain that access over extended periods.”

Rapid7 is working with organizations it believes may be impacted and, to support defenders in identifying potential BPFdoor activity, has released a free, open-source scanning script . The scanning script is designed to detect both previously documented BPFDoor variants and newer samples, and is available to assist organizations in proactively identifying potential compromises. Rapid7’s goal is to help defenders rapidly validate exposure and begin incident response investigations where necessary. In addition, Rapid7 has incorporated these findings across its detection capabilities, including retroactive threat hunting and updated intelligence available to customers through the Rapid7 Intelligence Hub .

On Thursday, March 26 at 12:20 p.m. PT at RSAC 2026 Conference in San Francisco, Christiaan Beek will be presenting the full scope of this research in his session, “ Sleeper Cells in the Telecom Backbone .”

On Monday, March 30, Raj Samani and Christiaan Beek will the findings and the impact on global telecommunications in this exclusive webinar .

Rapid7 Media Relations Stacey Holleran Sr. Manager, Global Communications [email protected] (857) 216-7804

Rapid7 Investor Matt Wells Vice President, Investor Relations [email protected] (617) 865-4277