Stocktitan Rapid7 Reports State-Sponsored Espionage in Global Telecoms
Article Content
- •A China-nexus threat actor, Red Menshen, has gained covert access to global telecom infrastructure.
- •The espionage campaign poses significant risks to national security and critical systems.
- •Rapid7 has released a scanning tool to help organizations detect potential compromises.
Rapid7 Labs has identified a sustained espionage campaign by a China-nexus threat actor, Red Menshen, targeting global telecommunications infrastructure. The research, titled 'Sleeper Cells in the Telecom Backbone,' reveals long-term access that poses a national security concern due to the potential for intelligence collection on entire populations. Key vulnerabilities include kernel-level backdoors and the abuse of encrypted HTTPS traffic. Rapid7 has released a free, open-source scanning script to help organizations detect potential compromises. The findings indicate critical visibility gaps in detection capabilities, emphasizing the need for preemptive detection strategies. Rapid7 is actively working with affected organizations to mitigate risks. The research was presented at the RSAC 2026 Conference on March 26, 2026.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track Red Menshen and BPFDoor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
.png)
Stealthy Linux Backdoors Target Telecoms in South Korea and Taiwan Rapid7 has reported new Linux backdoors, specifically BPFDoor and AVERAT, targeting telecom and network-edge appliances in South Korea and Taiwan. These backdoors disguise their malicious traffic as legitimate email using SMTP on TCP port 25, making detection difficult on mail security gateways. The malware can… 
KT Faces Prosecution Over Malware Breach and Log Deletion KT, a major South Korean telecommunications company, is facing prosecution after its Chief Privacy Officer ordered the deletion of logs related to a malware breach that occurred in March 2024. The Personal Information Protection Commission (PIPC) found that KT failed to report the breach and neglected to analyze the…