Security firm Rapid7 said Friday it has found new variants of the BPFDoor backdoor and a previously undocumented Linux implant it calls AVERAT on network-edge systems in South Korea and Taiwan, with both disguised as mail-security software and communicating over the port normally used for email. The research, published on Rapid7's blog, describes two overlapping campaigns aimed at telecommunications and network-edge operators.

What Happened

In the South Korean cluster, the attackers used new BPFDoor builds and a modified version of the Rekoobe backdoor that impersonate SpamSniper, an anti-spam product used mainly in South Korea. Samples created a fake SpamSniper process ID file and spoofed the product's daemon and directory names so they would look like part of the appliance.

In the Taiwanese cluster, Rapid7 found AVERAT, a modular implant it analyzed in six builds. AVERAT is tied to appliances from Taiwanese vendor ShareTech; its dropper derives its encryption key from a hash of the word "ShareTech." The implant can run up to 10 shell sessions at once and supports file operations, process control, module loading and proxy channels.

RelatedU.S. Seizes Integrity Tech Hacking Tool Sites as Seven Nations Detail Flax Typhoon Ops

Both families lean on TCP port 25, the standard port for mail transfer. AVERAT connects outward, sends the usual opening commands of an email session and only then starts its own encrypted channel, so the traffic resembles a mail relay talking to another server. The Rekoobe build's packet filter reacts only to traffic with port 25 on both ends, matching the firewall rules mail gateways typically allow.

Rapid7 also reconstructed features from BPFDoor's controller, including tunneling over HTTPS, and found "data plane" variants that fold in code from the Tinyshell and Rekoobe tools to support data theft.

Why It Matters

Mail-security gateways sit inline in front of mail servers and are trusted to see and filter traffic. An implant that looks like the gateway's own software, on a port the gateway is expected to use, is hard to spot with network monitoring or a casual review of running processes.

The dropper adds to that. It stages its binaries under system-sounding names, runs them and deletes the files from disk about 10 seconds later while the processes keep running. The device's own startup routine relaunches the malware, so no separate persistence mechanism is needed.

Infrastructure and Attribution

The command-and-control relays were three compromised devices on Taiwanese broadband connections: a Synology storage device at a fuel retailer, an aging NetKlass network appliance and a Dahua video recorder. All three ran operator-installed PPTP VPN servers with identical banners.

Rapid7 said that setup matches the device profile that CISA, the U.K.'s NCSC and partner agencies described in an April 2026 advisory as the standard building blocks of China-nexus covert relay networks, often called ORB networks. It did not name a threat group, and said it found no overlap with any specific known ORB network.

BPFDoor has a long track record in espionage against telecom operators, and Rapid7 published research on stealthy variants in March and April.

What to Watch

Rapid7 recommends hunting for processes whose executable has been deleted from disk, unexpected raw sockets or packet filters on systems that should not be capturing traffic, and outbound port 25 connections from processes that are not mail software. Open questions include whether ShareTech or SpamSniper's developer issue guidance for their customers and whether South Korean or Taiwanese national CERTs publish advisories.