New BPFDoor Variants Use Stateless C2 and ICMP Relays to Evade Detection

A dangerous Linux backdoor called BPFDoor has returned in a more powerful form, with researchers uncovering new variants built to stay invisible inside critical network infrastructure.

Linked to a China-nexus threat actor group known as Red Menshen, these updated versions target Linux servers embedded deep inside global telecom networks.

Unlike earlier strains, the new variants come equipped with techniques that make them far harder to detect and even harder to remove once they are inside a compromised system.