Rapid7 details BPFDoor and AVERAT implants targeting telecom edge devices

Rapid7 has published research on a cluster of Linux implants that disguise themselves as legitimate software on telecom and network-edge appliances. The set includes a new BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of an implant Rapid7 tracks as AVERAT, deployed against Taiwanese appliances.

The dropper writes a shell script to the appliance’s storage mount, stages two payloads into /sbin as ntpdate and udevds, launches them, and deletes each file ten seconds later while the processes keep running. Its encryption key is derived from the string ShareTech, and the BPFDoor variants impersonate the PID file of Korean anti-spam product SpamSniper.

AVERAT beacons outbound on port 25 using SMTP and STARTTLS, checking in every 600 to 699 seconds. Rapid7 said the command-and-control relays are compromised consumer and small-business devices in Taiwan, including a Synology NAS, an obsolete NetKlass appliance and a Dahua recorder, all running PPTP on port 1723.