New Linux Backdoors Exploit Telecoms via SMTP Traffic

• •Linux backdoors exploit telecom devices in South Korea and Taiwan.
• •Backdoors disguise traffic as legitimate email to evade detection.
• •Rapid7 recommends monitoring outbound connections on affected devices.

Linux backdoors targeting telecom and network-edge devices in South Korea and Taiwan have been discovered, masquerading as legitimate email traffic. Rapid7 reported on October 2, 2026, that these backdoors include a BPFDoor variant and a BPF Rekoobe build, alongside a dropper and six AVERAT implant builds. The AVERAT implant operates over TCP port 25, using SMTP commands to blend in with normal email traffic, making detection difficult. The implants can execute commands like file transfers and process terminations, and they check in every 600 to 699 seconds. The BPF Rekoobe variant disguises its traffic by mimicking the processes of a South Korean anti-spam product. Rapid7 noted that compromised devices in Taiwan were used as relays, matching profiles in a prior CISA advisory on covert networks. Investigation and mitigation recommendations have been issued, focusing on monitoring unexpected outbound connections and restricting management access to vulnerable devices.