Rapid7 uncovers Chinese 'dormant cells' in telecom networks

Friday 27 March 2026 - 09:20

By: Dakir Madiha

Rapid7 uncovers Chinese 'dormant cells' in telecom networks

Rapid7 detailed Thursday how a China-linked threat actor, Red Menshen, planted stealthy BPFdoor backdoors in global telecom networks using Linux kernel-level malware. First revealed in 2022, BPFdoor leverages Berkeley Packet Filter technology to passively monitor network packets without opening ports or signaling activity, evading standard endpoint detection tools. Presented at RSAC 2026 in San Francisco, the findings show a new variant hiding command triggers in encrypted HTTPS traffic via SSL endpoints like load balancers and proxies.

The malware targets telecom-specific protocols such as SCTP, enabling subscriber activity surveillance, location tracking and identity data collection on 4G and 5G networks. This marks a shift from opportunistic hacks to deliberate long-term prepositioning, with implants mimicking legitimate infrastructure services. Rapid7 released a free open-source detection script for organizations to scan for BPFdoor remnants.

In a related Linux threat, Check Point Research exposed VoidLink earlier this year—a cloud-native malware framework built primarily with AI assistance, likely by a single developer using the TRAE AI-centric IDE to produce over 88,000 lines of functional code in under a week. First spotted in December 2025, it auto-profiles targets and deploys tailored rootkits: eBPF on 6.x kernels, hybrid eBPF-LKM on 5.x, and remotely compiled loadable modules on older versions.

Sysdig analysis found VoidLink's command-and-control server compiles victim-specific rootkits on demand—a novel wild technique. Both threats exploit expanding Linux use in cloud platforms, container orchestration and telecom infrastructure. Ericsson warned last year that BPFdoor persists in Kubernetes environments at the node level even after pod restarts, while VoidLink probes cloud metadata APIs and enumerates Kubernetes and Docker setups for misconfigurations and privilege escalations.