Red Menshen's BPFDoor Hides Inside Telecom Networks Across 10 Countries

Red Menshen is a China-nexus advanced persistent threat cluster active since at least 2021, assessed with moderate-to-high confidence by Rapid7 Labs as aligned with People's Republic of China intelligence objectives. The group operates under at least four tracked designations: Red Menshen (Rapid7), Earth Bluecrow (Trend Micro), DecisiveArchitect, and Red Dev 18.

The group's defining characteristic is patience. Red Menshen does not conduct smash-and-grab operations. It implants persistent access inside telecom network infrastructure and waits, maintaining dormant footholds for months or years before collecting specific intelligence. Attribution rests on consistent tool reuse across geographically separated intrusions, operational patterns consistent with PRC-aligned intelligence priorities, and BPFDoor's unique design characteristics, which require kernel-level development capability not widely available to criminal groups.

Red Menshen has not been publicly sanctioned or indicted as of July 2026, unlike several other PRC-attributed threat actors. Western governments have attributed BPFDoor activity publicly, but no criminal charges have been filed against specific individuals. The group continues to operate and upgrade its tooling, with the March 2026 Rapid7 disclosure representing the most detailed public technical analysis of their current capabilities.

The group's espionage focus aligns with reported PRC strategic intelligence priorities: tracking dissidents, monitoring government-linked communications, and building persistent access to critical infrastructure that could support future operations during geopolitical escalation. For comparison, Russia's FSB Center 16 used the same infrastructure-targeting approach against energy and government networks, a parallel that illustrates how nation-state espionage groups treat network infrastructure as the primary long-term target.

BPFDoor is a Linux backdoor that installs a Berkeley Packet Filter (BPF) rule directly inside the operating system kernel, allowing it to inspect every packet arriving at a network interface without binding to any listening port. The filter monitors traffic silently. When a specifically crafted trigger packet arrives, the backdoor activates a reverse shell and connects outbound to attacker infrastructure. From the network's perspective, nothing unusual has occurred.

The latest variants documented by Rapid7 Labs in March 2026 add three significant capabilities to this baseline. First, the HTTPS-camouflaged trigger: the magic packet is embedded inside normal-looking HTTPS traffic at a fixed byte offset, a technique called the "magic ruler." Standard deep packet inspection tools operating on encrypted traffic cannot distinguish this from a legitimate web request without session keys. Second, ICMP tunneling: an attacker-controlled host signals BPFDoor variants across internal network segments using ICMP packets with a specific destination marker field (0xFFFFFFFF), enabling lateral movement commands that appear as routine ICMP traffic. Third, process masquerading: recent BPFDoor builds disguise themselves as HPE ProLiant management services (hpasmlited) and Docker daemon processes, with matching process names and command-line arguments.

Variant F, identified targeting telecom signaling infrastructure, adds SCTP (Stream Control Transmission Protocol) support. SCTP is a transport-layer protocol used natively in telecom signaling (SS7, Diameter, 5G N interfaces), which means Variant F can activate from signaling-plane traffic and potentially intercept subscriber authentication flows, location updates, and call routing data. A compromised HLR/HSS gives an attacker the ability to track any subscriber on that network in real time.

Telecommunications is the primary target. Red Menshen gains access to telecom networks specifically to reach subscriber management systems (HLR, HSS, UDM), authentication platforms (AuC), roaming databases, billing systems, and 4G/5G core network functions including AMF, SMF, and UDM in Kubernetes pods. These systems collectively manage the identities, locations, and communications of hundreds of millions of mobile subscribers.

Rapid7 Labs confirmed active attacks across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in their March 2026 report. CYFIRMA's broader profile documents confirmed targeting across Egypt, India, the Middle East, Myanmar, South Korea, Thailand, Turkey, the United States, Vietnam, and Cambodia. The geographic distribution reflects PRC strategic intelligence priorities: countries in Southeast Asia and the Middle East where China has significant economic, political, and military interests.

Government networks are the secondary target. Red Menshen uses telecom access as a pathway into government systems, exploiting the direct routing connections that carrier infrastructure maintains to public sector networks. A compromised border gateway at a national telecom operator can provide persistent visibility into government communications that cross the carrier's network, without requiring a direct compromise of government endpoints.

Finance and retail sectors also appear in Trend Micro's targeting data, suggesting the group maintains capabilities against non-telecom targets, though these are assessed as secondary to the core espionage mission. North Korea's Lazarus Group used a similar multi-sector targeting approach to fund operations while maintaining espionage access, illustrating how state-sponsored groups often maintain parallel track operations against different target classes.

Red Menshen's intrusion chain begins at internet-facing edge infrastructure. The group exploits public-facing VPN appliances, firewalls, and web platforms (T1190: Exploit Public-Facing Application). Confirmed initial access vectors include Ivanti Connect Secure VPN, Cisco IOS and JunOS devices, Fortinet firewalls, VMware ESXi hosts, Palo Alto Networks appliances, and Apache Struts-based web applications. The group also abuses valid accounts obtained through credential harvesting or brute force (T1078: Valid Accounts).

Post-exploitation follows a consistent pattern. BPFDoor provides persistent kernel-level access (T1547: Boot or Logon Autostart Execution). The backdoor actively impairs detection by operating below the visibility of standard security tools (T1562: Impair Defenses; T1036: Masquerading). Command-and-control uses application-layer protocols including HTTPS camouflage and ICMP tunneling (T1071: Application Layer Protocol; T1572: Protocol Tunneling). Lateral movement deploys CrossC2, Sliver, and TinyShell (T1570: Lateral Tool Transfer; T1021.004: SSH). Credential harvesting uses Mimikatz on Windows systems, custom ELF keyloggers on Linux, and SSH brute-forcers pre-loaded with telecom-specific credential pairs including the "imsi" username (T1110: Brute Force; T1056: Input Capture).

On Linux and Solaris systems, BPFDoor performs data collection by intercepting SCTP signaling traffic (T1119: Automated Collection). Windows lateral movement uses Mangzamel and Gh0st RAT variants alongside Metasploit (T1059: Command and Scripting Interpreter). The full kill chain from initial access to long-term persistent access can be compressed into days, with the group then maintaining dormant access for months before executing collection objectives.

No CVE-specific Sigma rule exists for Red Menshen BPFDoor because the backdoor does not exploit a vulnerability with a CVE assignment; it abuses a legitimate Linux kernel feature (Berkeley Packet Filter). Two behavior-based Sigma rules directly target BPFDoor's known artifacts and techniques.

Both rules require Linux auditd logs. Enable auditd on all Linux servers and ship logs to your SIEM before deploying. The file-access rule fires when BPFDoor attempts to access its lock or PID files in /var/run, which the backdoor creates during initialization. The port-redirect rule fires when iptables is used to reroute TCP traffic for a specific attacker source IP, a technique BPFDoor uses to proxy attacker traffic through an invisible NAT rule that makes the reverse shell look like legitimate SSH.

Standard detection tools fail against BPFDoor because they look for open ports, listening sockets, or network connections. BPFDoor has none. Detection requires kernel-level visibility and specific hunting queries targeting BPFDoor's known behavioral artifacts.

Start with host-based indicators. Hunt for the file /dev/shm/kdmtmpflush on every Linux server. This is BPFDoor's lock file, written to shared memory on startup. Its presence alone is a confirmed indicator of compromise requiring immediate incident response. Scan process lists for processes named udevd running with the argument -d from an unexpected parent process, or processes named hpasmlited on systems without HPE ProLiant hardware. Both are documented Red Menshen masquerade techniques. Check for any ELF binary in /tmp, /dev/shm, or /bin with modified timestamps that do not match surrounding system files.

For network-layer detection, Rapid7 Labs published a detection script on GitHub that scans for kernel BPF filter installations and anomalous raw socket usage: run it on all internet-facing Linux systems. Monitor auditd for accesses to the /var/run PID and lock file paths listed in the Sigma rules above. Monitor iptables NAT rules for REDIRECT entries tied to specific source IP addresses; BPFDoor creates per-attacker NAT rules that are not present in standard configurations. Inspect ICMP traffic for packets with the destination unreachable field set to 0xFFFFFFFF, which is the inter-host signaling marker for the latest BPFDoor variant.

For 4G/5G core environments: monitor SCTP flows for unexpected session establishment patterns, particularly from hosts outside the normal network element peer group. An HLR or HSS receiving SCTP connections from hosts that are not registered as legitimate network elements should be investigated immediately.

Defending against Red Menshen requires addressing three separate surfaces: edge device security (initial access), Linux server hardening (persistence), and telecom signaling visibility (collection). Standard endpoint security tools do not cover BPFDoor because the backdoor operates at kernel level below EDR visibility on most Linux deployments.

The most urgent action for any organization running internet-facing Ivanti, Cisco, Fortinet, or Palo Alto infrastructure is to verify patch status on all listed appliances and hunt for BPFDoor artifacts on any Linux systems reachable from those appliances. Compromised edge devices are the entry point; BPFDoor is the persistence mechanism that follows once the attacker has internal access.