Researchers identify Linux backdoors disguised as regional email security tools

Rapid7 researchers identified a new BPFDoor variant and a previously unreported Linux implant called AVERAT targeting telecom and network appliances in South Korea and Taiwan, The Hacker News reported. The malware impersonates regional email security products, including SpamSniper and ShareTech, to make its processes appear legitimate. The BPFDoor variant can receive activation signals inside standard HTTPS requests through edge proxies, potentially evading conventional traffic inspection. AVERAT uses email protocol traffic for operator communications and supports file transfers, interactive shells, appliance reboots and proxy connections. Rapid7 said its command infrastructure resembles an operational relay network, but found no evidence linking it to known networks of that kind.