Linux Backdoors Pose as Email Security Tools to Hide in Korean and Taiwanese Networks

Rapid7 has analyzed a cluster of Linux backdoors aimed at telecom providers and network appliances in South Korea and Taiwan. What ties them together is "regionalized disguise": each sample is aware of which software runs on the targeted system and tailors its process names accordingly.

Impersonating legitimate binaries is a well-known evasion trick. But these samples go beyond borrowing file names — they assume the identity of email-security products popular in the region, SpamSniper and ShareTech. Vendor Jiran Group markets SpamSniper as "Korea's leading email security solution."

What was found

Against Korean targets, a new BPFDoor variant and a BPF Rekoobe build are in play. BPFDoor abuses the Berkeley Packet Filter mechanism: it inspects incoming traffic and only activates when it detects a "magic packet." Rapid7 links the family to Red Menshen (also known as Earth Bluecrow), which has targeted telecom providers since 2021.

The new variant shows the operators retooling in response to public disclosures. Once vendors wrote signatures for Layer 4 anomalies, the attackers shifted to edge proxies: the trigger is now wrapped in an ordinary HTTPS POST request, and in telecom environments where SSL offloading is common, this helps evade deep packet inspection.

Some BPFDoor samples mimic SpamSniper's PID file and rotate through ten Linux daemon names; another sets its process name to ora_ppmond, a nod to Oracle Database's PMON process. Once triggered, the backdoor launches a TinyShell session supporting an interactive shell plus uploads and downloads. The Rekoobe variant intercepts traffic on port 25 (TCP/UDP/SCTP) and likewise names its processes after SpamSniper components.

AVERAT in Taiwan

Taiwanese appliances face a previously unreported implant called AVERAT. It is delivered by a dropper — an ELF binary found in a ShareTech add-on directory — that derives its encryption key from the string "ShareTech." AVERAT uses SMTP for command-and-control, cloaking its activity as mail traffic: it polls its C2 over TCP port 25 every 600–699 seconds and supports a long list of commands, from listing directories and processes to rebooting the device, loading .so modules, and opening proxy channels.

AVERAT's infrastructure matches the device-class profile of an Operational Relay Box (ORB) network, though no link to known ORBs such as LapDogs was found.

Recommendations

Rapid7 advises reviewing unexpected raw packet sockets and BPF filters on systems that don't need packet capture, auditing outbound port 25 connections from non-mail processes, scanning for processes posing as common daemons, and restricting management access to routers, DVRs, and other edge appliances. The actors are exploiting the privileged position of email gateways for intelligence collection — as seen in the 2023 attacks on Barracuda ESG.

Source: The Hacker News