#bpfdoor — Public Fediverse posts

Wie moderne #Schadsoftware im #Netzwerk untertaucht ( #CC2tv Folge 431)

#BPFDoor ist eine unauffällige #Backdoor für #Linux-Systeme und zeigt, wie gezielte #Malware-Angriffe heute funktionieren. Das Video erklärt, wie ein kompromittiertes System über präparierte #Netzwerkpakete aktiviert werden kann, ohne offene Ports oder sichtbare Dienste zu benötigen.

#computerclubzwei

https://youtube.com/watch?v=xtmbtZItfNE

Wie moderne #Schadsoftware im #Netzwerk untertaucht ( #CC2tv Folge 431)

#BPFDoor ist eine unauffällige #Backdoor für #Linux-Systeme und zeigt, wie gezielte #Malware-Angriffe heute funktionieren. Das Video erklärt, wie ein kompromittiertes System über präparierte #Netzwerkpakete aktiviert werden kann, ohne offene Ports oder sichtbare Dienste zu benötigen.

#computerclubzwei

https://youtube.com/watch?v=xtmbtZItfNE

Versteckte Linux-Malware in Telko-Netzwerken entdeckt
https://glm.io/207004?n #Cybercrime #Malware #BPFDoor #Linux

Versteckte Linux-Malware in Telko-Netzwerken entdeckt
https://glm.io/207004?n #Cybercrime #Malware #BPFDoor #Linux

📰 China-Linked 'Red Menshen' APT Creates 'Digital Sleeper Cells' in Telecoms with BPFDoor

🇨🇳 China-linked APT 'Red Menshen' is planting stealthy BPFDoor backdoors in global telecom networks. The malware creates 'digital sleeper cells' for long-term espionage. 📡 #APT #BPFDoor #CyberEspionage

🔗 https://cyber.netsecops.io/articles/china-linked-apt-red-menshen-deploys-bpfdoor-in-global-telecom-networks/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

BPFdoor in Telecom Networks: Sleeper Cells in the Backbone
#BPFDoor #RedMenshen #CrossC2
https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/

BPFdoor in Telecom Networks: Sleeper Cells in the Backbone
#BPFDoor #RedMenshen #CrossC2
https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/

27 миллионов абонентов под угрозой: разбор крупнейшей кибератаки на корейский телеком

Что нужно, чтобы скомпрометировать данные 27 миллионов абонентов, обрушить акции телеком-гиганта и поставить под угрозу национальную безопасность одной из самых технологически развитых стран мира? Свежий zero-day? Квантовый компьютер? Гениальная социальная инженерия? Всего лишь веб-шелл, почти три года преступной халатности и один хитрый бэкдор. Неизвестные злоумышленники с июня 2022 года хозяйничали в критической инфраструктуре крупнейшего корейского сотового оператора. Под катом мы разберем эту громкую историю.

https://habr.com/ru/companies/bastion/articles/930716/

#атака #кибербезопасность #телеком #смартфоны #сотовая_связь #информционная_безопасность #тестирование_itсистем #BPFDoor #бэкдор

As usual, @haxrob's reporting on Linux malware really is excellent:

* https://haxrob.net/bpfdoor-past-and-present-part-1/
* https://haxrob.net/bpfdoor-past-and-present-part-2/

More proof if it were needed that Linux targetting threat actors have been hanging around for the last decade or two but largely avoided the limelight.

#threatintel, #linux, #bpfdoor

As usual, @haxrob's reporting on Linux malware really is excellent:

* https://haxrob.net/bpfdoor-past-and-present-part-1/
* https://haxrob.net/bpfdoor-past-and-present-part-2/

More proof if it were needed that Linux targetting threat actors have been hanging around for the last decade or two but largely avoided the limelight.

#threatintel, #linux, #bpfdoor

New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks – Source:thehackernews.com https://ciso2ciso.com/new-bpfdoor-controller-enables-stealthy-lateral-movement-in-linux-server-attacks-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #BPFDoor

New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks – Source:thehackernews.com https://ciso2ciso.com/new-bpfdoor-controller-enables-stealthy-lateral-movement-in-linux-server-attacks-sourcethehackernews-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #TheHackerNews #BPFDoor

Enhanced Version of ‘BPFDoor’ Linux Backdoor Seen in the Wild https://www.securityweek.com/enhanced-version-of-bpfdoor-linux-backdoor-seen-in-the-wild/ #Malware&Threats #backdoor #BPFDoor #malware #China

Enhanced Version of ‘BPFDoor’ Linux Backdoor Seen in the Wild https://www.securityweek.com/enhanced-version-of-bpfdoor-linux-backdoor-seen-in-the-wild/ #Malware&Threats #backdoor #BPFDoor #malware #China

Enhanced Version of ‘BPFDoor’ Linux Backdoor Seen in the Wild https://www.securityweek.com/enhanced-version-of-bpfdoor-linux-backdoor-seen-in-the-wild/ #Malware&Threats #backdoor #BPFDoor #malware #China

Enhanced Version of ‘BPFDoor’ Linux Backdoor Seen in the Wild https://www.securityweek.com/enhanced-version-of-bpfdoor-linux-backdoor-seen-in-the-wild/ #Malware&Threats #backdoor #BPFDoor #malware #China

Somebody just uploaded a #BPFDoor sample from a box in India https://www.virustotal.com/gui/file/1900ab5b108eb8878634454c3e990a61fc8095fae82970e8e3b8593b9ece1eb7/summary

#threatintel

Somebody just uploaded a #BPFDoor sample from a box in India https://www.virustotal.com/gui/file/1900ab5b108eb8878634454c3e990a61fc8095fae82970e8e3b8593b9ece1eb7/summary

#threatintel

Another in the wild #BPFDoor - upload from Netherlands

https://www.virustotal.com/gui/file/cb43a25760ef65ce414849d2151ca032eb2055df9d21ebb838954f9368712c33/summary

Another in the wild #BPFDoor - upload from Netherlands

https://www.virustotal.com/gui/file/cb43a25760ef65ce414849d2151ca032eb2055df9d21ebb838954f9368712c33/summary

#BPFdoor implant uploaded by an org in Cambodia. https://www.virustotal.com/gui/file/074e298bed158aecdda82f3ac23b84afc78d83e6e9ae3a04a67e583497fb7e08

4f27f2ebe487e277f39783aa0ae3134f

#threatintel

#BPFdoor implant uploaded by an org in Cambodia. https://www.virustotal.com/gui/file/074e298bed158aecdda82f3ac23b84afc78d83e6e9ae3a04a67e583497fb7e08

4f27f2ebe487e277f39783aa0ae3134f

#threatintel

This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

> SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

From https://unfinished.bike/fun-with-the-new-bpfdoor-2023

This is a fun way to detect #bpfdoor and other minimalist #posix #malware using #osquery

> SELECT * FROM process_open_sockets WHERE fd=0 AND NOT (family = 1 AND protocol = 0);

It traverses /proc to find processes where the first file descriptor (typically stdin) is a socket — excluding local UNIX domain sockets as some legit programs do that.

This sounds like an unlikely detector, but I've only seen backdoors like #bpfdoor behave this way.

From https://unfinished.bike/fun-with-the-new-bpfdoor-2023

I found some fun time today to analyze the latest #bpfdoor #malware variant: https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - and write new detections for it and similar Linux malware.

Thanks to @GossiTheDog for providing the sample for analysis.

I found some fun time today to analyze the latest #bpfdoor #malware variant: https://unfinished.bike/fun-with-the-new-bpfdoor-2023 - and write new detections for it and similar Linux malware.

Thanks to @GossiTheDog for providing the sample for analysis.

Previously on #BPFDoor https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Previously on #BPFDoor https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Cat is bagless - there’s a new version of #BPFDoor https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game

I’ve found it on orgs in Taiwan and Hong Kong so far.

Cat is bagless - there’s a new version of #BPFDoor https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game

I’ve found it on orgs in Taiwan and Hong Kong so far.

A new #BPFDoor sample, if that’s your thing. https://www.virustotal.com/gui/file/aa477897c51958aee57d854a531684551c99c9f992fc8e70963f2f93c962bff8

“Loads a Berkeley Packet Filter (BPF) sniffer allowing it to efficiently watch traffic and work in front of any locally running firewalls to see packets (hence BPFDoor).”

https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/

#Linux #BPFDoor #malware #dfir #CyberSecurity #infosec #cyber