Advanced persistent threats are constantly updating their methods to bypass modern network defenses. Recently, security researchers discovered seven new variants of the BPFDoor malware.
BPFDoor is a stealthy, kernel-level backdoor that uses Berkeley Packet Filters (BPFs) to monitor network traffic from deep within the operating system. It creates a silent trapdoor that threat actors can activate by sending a specific “magic packet” over the network.
This mechanism allows the malware to establish nearly undetectable sleeper cells, particularly within the global telecommunications infrastructure.
Recent analysis of nearly 300 malware samples identified two primary new variants: httpShell and icmpShell.
These versions demonstrate a significant improvement in the attackers’ operational security. Historically, BPFDoor tried to appear fileless by running from temporary memory and deleting itself upon execution.
However, because modern endpoint security tools easily flag this behavior, the new variants now reside directly on the disk.
They use hardcoded process names to blend in as normal system background processes, making them much harder to detect on compromised machines.
Advanced Routing and Multi-Protocol Capabilities
One of the most impressive new features is the malware’s use of stateless C2 routing. By setting a specific flag in the magic packet, the malware ignores hardcoded IP addresses. Instead, it sends its reverse shell directly back to the source IP found in the packet that woke it up.
This allows attackers to control the malware from behind VPNs or network address translation (NAT) without needing to hardcode their own external IP addresses into the payload.
The threat actors have also introduced multi-protocol parallel sniffing. Some variants use a multi-threaded architecture to monitor TCP, UDP, and ICMP traffic simultaneously.
By dedicating a separate thread to each protocol, the malware ensures it never misses a wake-up trigger, even on busy networks.
This parallel design makes the attackers highly resilient to security changes. If a defender blocks unusual ICMP traffic, the attackers can switch to sending their triggers over TCP without missing a beat.
According to Rapid7 research, other new variants show deep awareness of their environment. One specific version targets bare-metal HPE ProLiant servers commonly used in 5G telecom networks.
It masquerades as legitimate HPE management software and even kills the real system agent to take its place. Another variant moves away from complete silence and uses an active beacon.
It bypasses firewalls by masquerading as routine Network Time Protocol (NTP) traffic over SSL, reaching out to domains that appear to be standard system updates.
To defend against these stealthy tactics, security teams must shift their detection engineering strategies.
Instead of looking for traditional payload signatures, defenders should look for structural anomalies in network traffic, such as hardcoded sequence numbers or invalid protocol codes.
Monitoring for spoofed processes running as root and checking for active BPF filters attached to packet sockets is critical for identifying these advanced threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
