Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

The Red Menshen threat group deployed Linux backdoors (including BPFDoor variants and AVERAT) on telecom and network appliances in South Korea and Taiwan by disguising malicious traffic and processes as trusted email security products and Oracle database services. This technique — known as process masquerading — exploits the assumption that familiar process names are inherently safe, allowing attackers to persist undetected for extended periods. The attack highlights a critical gap in runtime process validation and network traffic inspection, particularly on appliances that are often less rigorously monitored than traditional endpoints. Organizations that rely solely on name-based allowlisting or signature detection without behavioral analysis are especially vulnerable to this class of evasion.