BPFDoor and AVERAT Target Network Edge Appliances

Rapid7 has identified a sophisticated campaign targeting network edge infrastructure, specifically telecommunications appliances, mail gateways, and consumer/SMB devices in Taiwan and South Korea. The threat actors utilize a modular ecosystem consisting of a custom dropper, BPFDoor variants, Rekoobe backdoors, and a new Linux implant named AVERAT. The campaign is notable for its 'regionalized disguise,' where malware components impersonate legitimate local software, such as the SpamSniper anti-spam product in South Korea and ShareTech appliances in Taiwan.

Technically, the actors excel at network evasion by using Berkeley Packet Filter (BPF) raw sockets to sniff for 'magic packets' and tunneling C2 traffic through legitimate-looking SMTP (Port 25) and HTTPS POST requests. This allows the implants to remain passive until triggered, bypassing standard stateful firewalls. The infrastructure relies heavily on Operational Relay Boxes (ORBs) comprised of compromised end-of-life NAS units, DVRs, and routers, consistent with China-nexus threat actor tradecraft.

The business impact is high for telecommunications and network-edge operators. Because these implants sit at the network core or gateway, they provide adversaries with deep visibility into inbound/outbound traffic and a persistent foothold for lateral movement, all while remaining fileless in memory to evade traditional host-based detection.