BPFdoor in Telecom Networks: Detecting and Evicting Passive Linux Backdoors in Backbone Infrastructure

This week at Virus Bulletin 2026 in Seville, Rapid7's intelligence team received the Péter Szőr Award — the industry's most rigorous recognition of deep technical security research — for their work "BPFdoor in Telecom Networks: Sleeper Cells in the Backbone." Awards ceremonies don't usually matter to practitioners. This one does. The research being honored documents active, long-dormant BPFdoor implants embedded inside telecommunications backbone infrastructure — the carrier-grade Linux systems that route, switch, and inspect traffic for entire regions.

Péter Szőr built his career on meticulous, no-shortcuts malware analysis. The fact that this research earned his namesake award tells you two things: the technical work is exceptional, and the threat it documents is real, current, and sitting in networks that most defenders assume are too well-managed to be compromised.

If you operate telecom infrastructure, ISP backbone systems, or any Linux-based network appliance fleet — BGP route servers, DPI platforms, SBCs, softswitches, monitoring probes — you should treat this as an active hunting priority, not an interesting paper.

Why BPFdoor Changes the Detection Calculus

BPFdoor represents a class of implant that defeats the detection logic most SOC teams rely on. Traditional backdoors open a listening port or beacon outbound. Both are observable: netstat shows the socket, the firewall logs the connection, the EDR sees the listener. BPFdoor does neither.

How the implant works

The implant leverages the Berkeley Packet Filter (BPF) — the same in-kernel packet filtering machinery that powers tcpdump — to inspect traffic at the network layer before the operating system's networking stack processes it. The attack chain, from a defender's vantage point:

1. Delivery and masquerade. The implant is dropped onto a compromised Linux host (typically via a prior intrusion vector: exposed SSH, vulnerable management interfaces, or supply-chain access) and renamed to blend with legitimate system daemons. Historical BPFdoor variants have disguised themselves as innocuous services and stored artifacts in volatile or low-scrutiny paths such as /dev/shm.

2. Passive packet interception. Rather than binding a port, the implant attaches a BPF filter and inspects every packet traversing the interface. Because it operates at the raw socket / BPF layer, no listening socket ever appears in ss -tlnp, netstat, or most EDR network inventories. The host looks clean.

3. Magic packet activation. The operator sends a crafted "magic" packet — historically via TCP, UDP, or ICMP with specific payload markers — from anywhere in the world. The BPF filter matches it, the implant wakes, and it spawns a reverse shell or executes commands. All other traffic passes unmodified. To network monitoring, the implant is invisible until the moment it's used.

4. Dormancy. Between activations, the implant does nothing. No C2 heartbeat, no scheduled callbacks, no beacon timing to catch with NetFlow analytics. This is why Rapid7's "sleeper cell" framing is accurate: these implants can sit in backbone infrastructure for years.

Why telecom backbone infrastructure is the target

Backbone and carrier systems are strategically ideal for this implant class:

• Long uptime, rare reboots. Carrier Linux systems run for years. Volatile-resident implants persist without needing robust persistence mechanisms.
• Massive traffic volume. A passive sniffer on a backbone interface has intelligence value even when dormant — and the noise floor hides activation packets.
• Thin endpoint coverage. EDR deployment on network appliances, route reflectors, and embedded Linux carrier gear lags far behind enterprise Windows/Linux server coverage. Many of these systems are "managed by the vendor" and monitored only for availability, not integrity.
• Trusted network position. Compromised backbone nodes become launch points for interception, redirection, and lateral movement into everything downstream.

Exploitation status

This is not theoretical. Rapid7's research documents implants in the wild, inside operational telecom networks, which is precisely why the work drew the industry's top research honor. There is no CVE here — BPFdoor is an implant, not a vulnerability — and defenders should not wait for a patch cycle that isn't coming. The remediation path is detection, eviction, and hardening.

Detection & Response

The defensive challenge is that BPFdoor's entire design goal is invisibility to conventional checks. You cannot find it by looking for listeners. You find it by hunting the artifacts of how it hides:

• Processes holding raw sockets (SOCK_RAW / AF_PACKET) that have no business sniffing
• Promiscuous-mode interfaces on systems that don't run sanctioned capture tools
• BPF programs and maps loaded on hosts where no one deploys eBPF tooling
• Executables running from /dev/shm or other memory-backed filesystems
• Masqueraded process names whose on-disk binaries don't match legitimate packages
• Timestomped or package-unowned binaries in system paths

The detection content below is engineered for high-signal hunting in backbone and carrier Linux environments. Baseline your sanctioned packet-capture tooling first — tcpdump, netsniff-ng, legitimate eBPF observability agents, and DPI functions will otherwise generate noise.

Sigma Rules

---
title: Linux Raw Socket Packet Sniffer Process Creation
tid: 3f9a2b71-8c4d-4e6f-a1b2-9d7c5e3f8a01
status: experimental
description: Detects execution of packet capture and raw socket tooling on Linux systems. On backbone and telecom infrastructure where sanctioned sniffing is rare and well-inventoried, unexpected BPF-capable tool execution is a strong BPFdoor-class implant indicator.
references:
  - https://www.rapid7.com/blog/post/tr-rapid7-intelligence-wins-2026-peter-szor-award-outstanding-research
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1040
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/tcpdump'
      - '/tshark'
      - '/dumpcap'
      - '/netsniff-ng'
      - '/ngrep'
      - '/dsniff'
      - '/ettercap'
  selection_bpftool:
    Image|endswith:
      - '/bpftool'
    CommandLine|contains:
      - 'prog load'
      - 'prog attach'
  condition: 1 of selection_*
falsepositives:
  - Sanctioned packet capture by network engineering teams
  - Legitimate eBPF observability agents (Cilium, Falco, Pixie) loading BPF programs
level: high
---
title: Execution From Memory-Backed Filesystem on Linux
tid: 7c1e4d92-5a3b-4f8e-b2c6-1d9a8e4f7b03
status: experimental
description: Detects process execution from /dev/shm, /run/shm, or tmpfs paths. BPFdoor-family implants favor memory-backed filesystems because artifacts vanish on reboot and evade disk-based integrity monitoring. Very few legitimate daemons execute from these paths.
references:
  - https://www.rapid7.com/blog/post/tr-rapid7-intelligence-wins-2026-peter-szor-award-outstanding-research
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.persistence
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|startswith:
      - '/dev/shm/'
      - '/run/shm/'
      - '/var/tmp/'
      - '/tmp/.'
  filter_known:
    Image:
      - '/tmp/.mount_'  # AppImage mounts
  condition: selection and not 1 of filter_*
falsepositives:
  - Rare legitimate tmpfs-resident tooling; verify package ownership before dismissing
level: high
---
title: Suspicious BPF Syscall Usage via Auditd
tid: 2b8f5a14-6d9c-4e1a-a7f3-5c2b8d6e9f04
status: experimental
description: Detects bpf() syscall invocation by processes outside the sanctioned eBPF/tooling set, per auditd syscall auditing. BPFdoor-class implants must interact with BPF infrastructure to attach filters; on carrier systems with no sanctioned eBPF workloads, any bpf() call is hunt-worthy.
references:
  - https://www.rapid7.com/blog/post/tr-rapid7-intelligence-wins-2026-peter-szor-award-outstanding-research
  - https://attack.mitre.org/techniques/T1040/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1040
logsource:
  category: auditd
  product: linux
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'bpf'
  filter_legit:
    exe|endswith:
      - '/cilium-agent'
      - '/falco'
      - '/bpftool'
  condition: selection and not 1 of filter_*
falsepositives:
  - Container runtimes and eBPF-based security agents; baseline per host role
level: medium

KQL — Microsoft Sentinel (Syslog/CEF ingestion)

Carrier Linux systems typically forward auditd and syslog into Sentinel via the Linux agent or CEF collectors. This hunt surfaces the BPFdoor artifact set across an ingested fleet — adjust the sanctioned-tool exclusions to your environment's inventory before broad deployment.

let SanctionedSniffers = dynamic(["tcpdump","tshark","dumpcap","cilium","falco"]);
let SanctionedPaths = dynamic(["/usr/sbin/","/usr/bin/","/opt/cilium/"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any ("bpf", "PROMISC", "promiscuous")
    | extend Host = Computer, Evidence = SyslogMessage),
    (CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where Message has_any ("/dev/shm/", "/run/shm/", "socket(PF_PACKET", "SOCK_RAW")
    | extend Host = DeviceName, Evidence = Message)
| where Evidence !has_any (SanctionedSniffers)
| summarize
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    SampleEvidence = take_any(Evidence),
    EventCount = count()
    by Host
| extend RiskScore = case(
    SampleEvidence has "/dev/shm/", 90,
    SampleEvidence has "socket(PF_PACKET", 80,
    SampleEvidence has_any ("PROMISC", "promiscuous"), 70,
    50)
| order by RiskScore desc, EventCount desc

For environments with Defender for Endpoint on Linux covering server infrastructure, layer in process-level hunting:

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("bpftool", "prog load", "prog attach")
   or FolderPath has_any ("/dev/shm/", "/run/shm/")
| extend IsPackageOwned = iff(FolderPath startswith "/usr/", "Likely", "Verify")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Commands = make_set(ProcessCommandLine, 10)
    by DeviceName, FolderPath, InitiatingProcessAccountName
| order by FirstSeen asc

Velociraptor VQL

For hands-on-keyboard forensics on suspect backbone nodes, this artifact combines the three highest-signal endpoint checks: raw packet sockets held by running processes, volatile-filesystem executables, and promiscuous interface state.

-- BPFdoor-class implant hunt: raw sockets, tmpfs executables, promiscuous interfaces
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()

LET suspicious_procs = SELECT * FROM procs
  WHERE Exe =~ '/dev/shm/|/run/shm/|/var/tmp/'
     OR CommandLine =~ 'bpftool|prog load|prog attach'

LET raw_sockets = SELECT Pid, Name, CommandLine,
       parse_file(path=format(format='/proc/%v/net/packet', args=Pid)) AS PacketSockets
  FROM procs
  WHERE path_exists(path=format(format='/proc/%v/net/packet', args=Pid))
    AND Name NOT IN ('tcpdump','tshark','dumpcap','cilium-agent','falco')

SELECT * FROM suspicious_procs
UNION ALL
SELECT Pid, Name, CommandLine, Exe='', Username='', CreateTime=NULL FROM raw_sockets

On a scoped host, follow up with direct verification: enumerate loaded BPF programs (bpftool prog list and bpftool map list), and compare running binaries against package-manager ownership — dpkg -S / rpm -qf on the executable path. An unowned binary masquerading under a system daemon name is an eviction trigger, not a watch item.

Remediation and Hardening Script

Run this triage-and-harden script (as root) on suspect or at-risk carrier Linux systems. It is intentionally read-only for the detection phase, then applies hardening controls. Adapt the sanctioned-tools list before use.

#!/bin/bash
# BPFdoor-class implant triage and hardening for carrier/backbone Linux
# Run as root. Review findings before any remediation action.

REPORT=/var/log/bpf_hunt_$(date +%Y%m%d_%H%M%S).log
exec > >(tee -a "$REPORT") 2>&1

echo "=== [1] Promiscuous-mode interfaces (unexpected sniffing) ==="
ip -o link | grep -i promisc || echo "None found"

echo "=== [2] Processes holding raw packet (AF_PACKET) sockets ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  if ls -l /proc/$pid/fd 2>/dev/null | grep -q socket; then
    exe=$(readlink /proc/$pid/exe 2>/dev/null)
    comm=$(cat /proc/$pid/comm 2>/dev/null)
    echo "PID $pid ($comm) -> $exe"
  fi
done
ss -xlp 2>/dev/null | grep -i packet

echo "=== [3] Loaded BPF programs and maps ==="
if command -v bpftool >/dev/null; then
  bpftool prog list
  bpftool map list
  bpftool net list
else
  echo "bpftool not installed; check /sys/fs/bpf and /proc for BPF artifacts"
  ls -la /sys/fs/bpf/ 2>/dev/null
fi

echo "=== [4] Executables running from memory-backed/volatile paths ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  exe=$(readlink /proc/$pid/exe 2>/dev/null)
  case "$exe" in
    /dev/shm/*|/run/shm/*|/var/tmp/*|/tmp/*)
      echo "SUSPICIOUS: PID $pid running $exe" ;;
  esac
done

echo "=== [5] Package-ownership verification of running binaries ==="
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  exe=$(readlink /proc/$pid/exe 2>/dev/null)
  [ -z "$exe" ] && continue
  case "$exe" in /usr/*|/sbin/*|/bin/*)
    if command -v dpkg >/dev/null; then
      dpkg -S "$exe" >/dev/null 2>&1 || echo "UNOWNED (dpkg): PID $pid $exe"
    elif command -v rpm >/dev/null; then
      rpm -qf "$exe" >/dev/null 2>&1 || echo "UNOWNED (rpm): PID $pid $exe"
    fi ;;
  esac
done | sort -u

echo "=== [6] Deploying auditd rules for bpf() and promiscuity changes ==="
cat > /etc/audit/rules.d/99-bpfdoor-hunt.rules <<'EOF'
-a always,exit -F arch=b64 -S bpf -S finit_module -S init_module -k bpf_implant_watch
-a always,exit -F arch=b64 -S setsockopt -F a0>=0 -k socket_opt_watch
-w /dev/shm -p wa -k shm_exec_watch
EOF
augenrules --load && systemctl restart auditd
echo "Auditd rules deployed (key: bpf_implant_watch)."

echo "=== [7] Hardening: restrict unprivileged BPF ==="
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-bpf-hardening.conf
sysctl --system >/dev/null
echo "Unprivileged BPF disabled."

echo "Triage complete. Report: $REPORT"

Notes on the script:

• Step 5 is your highest-fidelity eviction signal. BPFdoor implants masquerade as legitimate daemons, but their binaries are not owned by any installed package. An unowned binary presenting as a system service warrants isolation and forensic imaging before removal.
• Step 7 disables unprivileged BPF (kernel.unprivileged_bpf_disabled=1), which raises the bar for implant operators and is safe on most carrier systems that don't run eBPF workloads. If you run Cilium, Falco, or similar, verify agent health after applying.
• Deploy auditd rules fleet-wide, not just on suspect hosts — dormant implants elsewhere in the backbone will eventually activate, and you want the syscall telemetry already in place when they do.

Remediation and Strategic Recommendations

There is no vendor patch for an implant. Remediation is operational:

1. Hunt now, fleet-wide. Run the detection content above across every carrier Linux asset — route servers, DPI nodes, SBCs, probes, jump hosts, and vendor-managed appliances where you have execution rights. Prioritize systems with long uptime and internet-adjacent interfaces.

2. Baseline sanctioned sniffing. Build and maintain an authoritative inventory of approved packet-capture tooling and eBPF workloads per host role. Every detection above depends on knowing what should be there. This is the control that converts BPFdoor from invisible to obvious.

3. Restrict BPF attack surface. Disable unprivileged BPF (kernel.unprivileged_bpf_disabled=1), restrict bpftool and eBPF tooling to administrative paths, and audit bpf() syscalls continuously via auditd forwarding into your SIEM.

4. Treat unowned binaries as incidents. Any running binary that fails package-ownership verification, executes from /dev/shm, or masquerades under a system daemon name triggers your IR process: isolate the host (carefully — backbone nodes carry traffic), capture memory and disk images, and hunt laterally using the magic-packet activation concept: look for asymmetric flows and anomalous ICMP/UDP to backbone interfaces in NetFlow.

5. Extend EDR/telemetry to network appliances. The coverage gap on carrier Linux is why this implant class thrives. Where agents aren't supported, compensate with auditd-to-SIEM forwarding, integrity monitoring (AIDE, or package verification on a schedule), and strict egress filtering — a passive implant's activation requires outbound capability for the reverse shell; deny it by default.

6. Review the primary research. Rapid7's award-winning analysis at the Virus Bulletin 2026 conference is the authoritative technical source for this campaign's indicators and tradecraft. Assign a senior analyst to extract IOCs and behaviors from the published research and fold them into your detection engineering backlog this sprint — not this quarter.

7. Assume dormancy elsewhere. "Sleeper cells" means the implants found are the ones someone looked for. Absence of findings after one hunt is not assurance; schedule recurring hunts and keep syscall auditing permanent.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub