Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Rapid7 researchers have uncovered Linux malware families hitting telecom and network edge appliances in South Korea and Taiwan that disguise themselves as trusted email-security software to avoid detection. In South Korea, a new BPFDoor variant and a related BPF Rekoobe build masquerade as processes belonging to the SpamSniper anti-spam product, while one sample also mimics Oracle's PMON process naming. In Taiwan, attackers deployed a previously undocumented implant called AVERAT, dropped through an ELF loader hidden in a ShareTech appliance directory and using encrypted SMTP traffic over port 25 for command-and-control. Both toolsets show how threat actors are refining BPF-based backdoors and abusing the trusted status of email-security appliances to blend malicious traffic into legitimate network noise, echoing earlier abuse of Barracuda ESG flaws tracked as CVE-2023-2868 and CVE-2023-7102.