Called BPFDoor, there is no indication from either PwC or Beaumont as to how the backdoor gains a foothold on any system.

Beaumont said it used a BPF packet filter and hence could do its job without opening any new network ports or firewall rules.

This seems to be a source code for the #BPFDoor malware (the controller) used by the Red Menshen TA

Maybe @jcksnsec can take a look at it for confirmation

Samplehttps://t.co/CzDMQw9Ax0

Sourcehttps://t.co/FuYur6zJYO pic.twitter.com/gSOrQ6Huza

— Florian Roth ⚡️ (@cyb3rops) May 8, 2022

PwC Threat Intelligence mentioned BPFDoor in its threat report for 2021, calling the individual(s) behind it Red Menshen, and claiming it had been targeting telcos in the Middle East and Asia.

It "also identified that the threat actor sends commands to BPFDoor victims via virtual private servers hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels".

Beaumont said he had found BPFDoor installed in a number of organisations in 2021, in the US, South Korea, Hong Kong, Turkey, India, Vietnam and Myanmar. These included systems in government, postal, logistics and education institutions.

"Operators have access to a tool which allows communication to the implants, using a password, which allows features such as remotely executing commands. This works over internal and Internet networks," he wrote.

11 of the endpoints infected with BPFDoor run Speedtest. It's unclear why. It's a Linux binary with no source code, where client request logging is disabled by default, which also has auto updates enabled.

— Kevin Beaumont (@GossiTheDog) May 10, 2022

"Because BPFDoor doesn’t open any inbound network ports, doesn’t use an outbound C2, and it renames its own process in Linux (so ps aux, for example, will show a friendly name) it is highly evasive."

PwC mentioned that its research showed Red Menshen was mostly active "between Monday to Friday (with none observed on the weekends), with most communication taking place between 01:00 and 10:00 UTC. This pattern suggests a consistent 8 to 9-hour activity window for the threat actor, with realistic probability of it aligning to local working hours".

Beaumont pointed out that each implant had its own hash, making detection by searching for hashes a waste of time.

He said another researcher, Florian Roth, had discovered source code for the BPFDoor controller on VirusTotal, a database of malware signatures owned by Google.