[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-eO6NObqsX3H5Y0Au9Z5fRMpKm3FPL2nNtKJMpBhbus":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":59,"controls":60},"c26616a1-ad9d-40ef-8018-17db8ed43079","linux-backdoors-masquerade-as-legitimate-tools-to-evade-detection","1a29ac76-837d-4898-b08d-54a27bf0cbd9","Linux Backdoors Masquerade as Legitimate Tools to Evade Detection","The Red Menshen threat group deployed Linux backdoors (including BPFDoor variants and AVERAT) on telecom and network appliances in South Korea and Taiwan by disguising malicious traffic and processes as trusted email security products and Oracle database services. This technique — known as process masquerading — exploits the assumption that familiar process names are inherently safe, allowing attackers to persist undetected for extended periods. The attack highlights a critical gap in runtime process validation and network traffic inspection, particularly on appliances that are often less rigorously monitored than traditional endpoints. Organizations that rely solely on name-based allowlisting or signature detection without behavioral analysis are especially vulnerable to this class of evasion.","**Immediate actions:**\n- Audit all running processes on Linux-based network appliances and telecom systems, verifying each process binary's hash and path against known-good baselines.\n- Deploy network traffic inspection tools capable of deep packet inspection to detect anomalous traffic patterns regardless of the port or service name used.\n- Isolate confirmed or suspected compromised appliances from the broader network immediately pending forensic investigation.\n\n**Detection measures:**\n- Implement behavioral-based EDR or host-based intrusion detection (e.g., auditd, Falco) on Linux systems to flag processes that use BPF filters or make unexpected outbound connections.\n- Establish baseline network flow profiles for all telecom and network appliances and alert on deviations, especially unexpected email-protocol traffic from non-mail servers.\n- Correlate process name, binary path, parent process, and network activity together — not process name alone — to detect masquerading techniques.\n\n**Long-term improvements:**\n- Enforce strict network segmentation around telecom and network appliances, limiting lateral movement and unauthorized outbound communication channels.\n- Maintain a continuously updated and verified inventory of all software running on network appliances, including version, hash, and expected behavior.\n- Conduct regular threat-hunting exercises focused on living-off-the-land and process masquerading techniques targeting Linux infrastructure.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1036: Masquerading","MITRE ATT&CK T1205.002: Traffic Signaling via BPF","NIST Cybersecurity Framework DE.CM-1: Network Monitoring","ITIL: Continual Service Improvement — Security Event Monitoring",{"MITRE ATT&CK T1036: Masquerading":23,"CIS Control 8: Audit Log Management":24,"NIST SP 800-53 SI-4: System Monitoring":25,"NIST SP 800-53 CM-7: Least Functionality":26,"NIST SP 800-53 SC-7: Boundary Protection":27,"CIS Control 13: Network Monitoring and Defense":28,"MITRE ATT&CK T1205.002: Traffic Signaling via BPF":29,"CIS Control 2: Inventory and Control of Software Assets":30,"NIST Cybersecurity Framework DE.CM-1: Network Monitoring":31,"ITIL: Continual Service Improvement — Security Event Monitoring":32},"Masquerading is how Red Menshen disguised backdoors, so verifying process paths and hashes is key.","Audit logs help detect anomalies like processes claiming to be email security products behaving unusually.","System monitoring that verifies process identity helps detect masquerading backdoors.","Least functionality reduces the services on appliances, making masquerading processes easier to spot.","Boundary protection can block or flag unusual inbound packets used to trigger BPFDoor.","Network monitoring can detect BPFDoor's magic packets and unusual traffic disguised as trusted services.","BPF-based traffic signalling lets BPFDoor wait for magic packets, which network monitoring can detect.","A software inventory helps identify unexpected processes and binaries masquerading as legitimate tools.","Network monitoring helps detect hidden backdoor traffic on telecom and network appliances.","Continual improvement of security event monitoring helps detect stealthy backdoors like these.","published","2026-10-06T22:22:06.109436+00:00","2026-10-06T22:22:05.813+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flinux-backdoors-impersonate-email.html","linux-backdoors-impersonate-email-security-tools-to-evade-detection-in-korea-and-4bb0cd","Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan",[41,47,53],{"id":42,"name":43,"slug":44,"description":45,"color":46},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":48,"name":49,"slug":50,"description":51,"color":52},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":54,"name":55,"slug":56,"description":57,"color":58},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[61,65,69],{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":66,"name":67,"problem":68},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":70,"name":71,"problem":72},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]