S1161 BPFDoor

platformsLinux

also known asBPFDoor · JustForFun · Backdoor.Linux.BPFDOOR · Backdoor.Solaris.BPFDOOR.ZAJE

BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.