Sleeper Cell Backdoors Are Here

What BPFdoor Means for Security Teams Right Now

Most attacks give you something to react to.

A spike in alerts. A user report. A system that suddenly stops behaving the way it should.

This one does not.

Rapid7 recently published research on a campaign that has been sitting inside telecom networks for an extended period of time. The malware, called BPFdoor, was not built to make noise or force a response. It was built to wait.

That is the part worth paying attention to.

This Was Not a Smash and Grab

The activity has been tied to a group known as Red Menshen. What stands out is not just where they targeted, but how they operated once inside.

They did not rush.

Instead, they placed access deep into the environment and left it there. No immediate action. No obvious movement. Just a foothold that could be used later.

That changes how you think about compromise.

It is not always an event. Sometimes it is a condition that already exists.

Why This One Is Hard to See

BPFdoor does not behave like the malware most teams are used to dealing with.

There is no open port sitting there waiting to be discovered. No regular callback to an external server. Nothing that clearly says “something is wrong” in a dashboard.

It listens quietly for a very specific packet. When that packet shows up, it responds. Until then, it stays out of the way.

It also runs at the kernel level on Linux systems. That alone puts it outside the visibility of a lot of traditional tooling.

Some variants even blend into encrypted traffic. From the outside, it looks like normal activity.

Which is exactly why it works.

The Bigger Shift

This is not just about one piece of malware.

It is a change in approach.

Attackers are spending more time thinking about persistence than speed. Getting in still matters, but staying in matters more.

If there is no alert and no disruption, how long would it take to notice?

That question is uncomfortable for a lot of teams.

The Entry Point Is Not the Sophisticated Part

Here is the part that should sound familiar.

Initial access in cases like this usually does not require anything advanced. It often comes down to things teams already know about but have not fully addressed.

• Internet-facing systems that are not locked down
• Credentials that should not still be active
• Configurations that were never revisited
• Known vulnerabilities that stayed open too long

None of that is new.

What is new is what happens after access is established.

Where Things Break Down

Most organizations have invested heavily in tools. That is not the issue.

The issue is understanding what those tools are actually doing, and where they are not.

BPFdoor lives in the gaps. Not because the tools are missing, but because the visibility is incomplete.

Kernel-level behavior is not always monitored. Internal traffic often gets less attention than external. Services that look legitimate tend to be trusted longer than they should be.

Put all of that together and it creates space.

That space is where this type of threat survives.

This Is Not Just a Telecom Problem

Telecom was the target here, but the technique applies almost anywhere.

If you are running Linux systems, cloud workloads, containers, or any kind of modern infrastructure, the same blind spots exist to some degree.

Most environments are layered and interconnected. That complexity is useful for the business. It also makes it easier for something to hide.

What This Means in Practice

If the only time you investigate is when an alert fires, you are already behind in this type of scenario.

You have to be able to answer some basic questions with confidence:

• What is actually running in the environment
• Whether controls are configured the way you think they are
• Where you have coverage and where you do not
• What activity would go unnoticed today

Those are not always easy answers to get.

Where Guardare Comes In

This is the exact problem Guardare is focused on.

Not replacing what you already have, but making sure it is doing what you expect.

Guardare connects across your existing environment and pulls together the pieces that are usually spread out across multiple tools.

That gives you a clearer picture of where risk actually exists.

In practical terms, that means:

Seeing the full environment
Understanding what assets, services, and configurations are present, not just what was deployed at one point in time.

Catching misconfigurations early
Identifying where controls are not set correctly or are not being used fully.

Connecting signals across tools
Finding patterns that would not stand out in isolation.

Highlighting blind spots
Showing you what is not being monitored so you can address it directly.

Providing clear next steps
Not just pointing out issues, but helping prioritize what to fix first.

Final Thought

BPFdoor is a reminder of something simple.

Not every threat is going to announce itself.

Some will sit quietly and wait for the right moment.

The difference comes down to whether you understand your environment well enough to catch what is not obvious.

That is where most organizations still have work to do.

‍

Ready to experience the difference a TRUE single pane of glass solution can make? Connect today and request a demo.