Linux malware described by Rapid7 is designed to look and behave like software expected on the edge appliance it compromises. Its samples imitate local process names and files, may run from deleted on-disk images, and can wait for matching network traffic rather than expose an obvious listening port. In a report published October 2, 2026, Rapid7 documented a newly observed BPFDoor variant, a BPF Rekoobe build, a dropper, and six AVERAT builds. These are distinct components, not proof of one interchangeable malware family or six victims.
What Rapid7 reported—and where
Rapid7 described samples found in appliance environments associated with South Korean and Taiwanese targets. It reported a BPF Rekoobe build against South Korean targets and six AVERAT builds deployed against Taiwanese appliances, alongside a newly observed BPFDoor variant and a dropper. The report frames telecom operators and network-edge systems as especially relevant, including embedded CCTV and DVR devices near the network core.
The findings concern those samples and environments. They do not establish that every Linux router, mail gateway, CCTV system, or device from a particular vendor is affected. Nor does the count of six AVERAT builds mean six confirmed victims.
How the malware blends into an appliance
The concealment is tailored to the device’s normal conventions rather than relying on one universal disguise. Rapid7 reported BPFDoor variants impersonating a SpamSniper PID file and rotating through common Linux daemon names. A BPF Rekoobe build used process names associated with Sniper appliance software as well as generic daemon names. The dropper appeared built for ShareTech appliances: its encrypted material used a key derived from “ShareTech,” and it wrote into an appliance add-on package directory.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
This device-specific detail matters during triage. A process name that looks ordinary on a general Linux host may be suspicious on a mail-security appliance—or the reverse. Compare names, PID artifacts, package paths, and expected services with the exact appliance model and its vendor-managed software, rather than treating a familiar-looking daemon name as proof of legitimacy.
Why a clean file-system check may miss it
Rapid7 described a staging sequence in which a script copies payloads into /sbin under ordinary-looking names, launches them, and deletes the files shortly afterward. The process can continue running after its original executable has been unlinked. A later scan of persistent files may therefore fail to show the image that started the process.
Rank #2
During a live investigation, examine the process executable link at /proc/<pid>/exe and look for executable memory mappings without backing files. Preserve process ancestry and arguments as well: the sequence of a script copying, launching, and removing a file may be more revealing than any one snapshot. A missing file alone does not establish compromise, but it is a reason to investigate the associated process and its activity.
How BPF and SMTP change network detection
Rapid7 says the BPF implants wait passively for matching traffic instead of simply opening an obvious listening port. BPF filters and raw packet sockets can let a process observe selected network packets without behaving like a conventional service bound to a visible port. As a result, an appliance with no unexpected listening port can still warrant investigation.
Recommended Free Tools
SMTP is a plausible camouflage channel on mail-security devices. The report calls attention to SMTP traffic, including port 25, and to unexpected callbacks from processes that are not mail services. It also notes that the port can be changed at runtime, so a fixed TLS ClientHello template may be a more durable network fingerprint than a particular port. For broader protocol-tunneling context, MITRE ATT&CK describes technique T1572; that general reference does not mean every sample in Rapid7’s report uses that technique.
What defenders should examine
Rapid7’s indicators are investigation leads, not individual proof of infection. On appliances where you can collect host data, correlate process, file, and network evidence rather than relying on a single alert.
Rank #4
- Process and memory: Check
/proc/<pid>/exefor unlinked executable paths, executable memory pages without backing files, suspicious process-name impersonation, and unusual process ancestry or arguments. - Packet access: Investigate unexpected raw packet sockets and classic BPF filters, particularly on systems with no operational need for packet capture.
- SMTP behavior: Review outbound port-25 activity from processes that are not mail services, including appliance callbacks to hostnames that resolve to consumer-grade or embedded devices.
- Staging traces: Look for a shell script with a misleading extension copying payloads into
/sbin, launching them, and removing them, as well as unexpected writes to appliance-specific add-on directories. - Network fingerprints: Compare TLS ClientHello characteristics across suspicious connections; do not rely on the destination port alone when the report says it may change at runtime.
How to preserve evidence and reduce exposure
Because short-lived files and process activity can disappear or change, preserve volatile context before restarting or cleaning a suspected device where incident-response procedures allow. Rapid7 specifically recommends retaining process trees, arguments, open file descriptors, socket metadata, and relevant historical DNS records. Coordinate with the appliance vendor or incident-response team if the device is closed or vendor-managed and you cannot safely collect this data yourself.
Restrict management access to edge devices and examine shared NFS or SMB mounts that might provide a route for writing executables to embedded systems. For ongoing threat-intelligence monitoring, Rapid7 identifies its Intelligence Hub as a source of additional indicators and YARA rules; such indicators should be evaluated in the context of the appliance and sample behavior rather than treated as a complete detection strategy.
What is—and is not—established about attribution
Rapid7 compared the infrastructure with wider relay-network patterns but said it found no overlap confirming membership in specified networks. The available findings do not establish a named actor responsible for every component or confirm that these samples belong to a particular operational relay network. Keep attribution separate from the technical observations: the reported process mimicry, file staging, and BPF behavior can be investigated without assigning the activity to a named group.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
