The BPFDoor malware has long been recognized as one of the most stealthy Linux backdoors in the wild. While it has been active for years, recent research shows that its codebase has evolved significantly. Threat actors are no longer relying solely on its original design; instead, they are iterating on leaked source code from 2022, introducing subtle but impactful enhancements that complicate detection and analysis.
Unlike typical malware families that undergo major rewrites, BPFDoor’s evolution is incremental. These small changes create a “messy” but highly effective toolkit that continues to evade modern security solutions.
From Fileless Execution to Disk-Based Persistence
Historically, BPFDoor operated as a fileless threat. It executed from /dev/shm and deleted itself immediately after launch, leaving minimal forensic traces. However, modern Endpoint Detection and Response (EDR) solutions began flagging processes running from deleted inodes in temporary filesystems.
To counter this, newer variants—particularly the httpShell variant—have abandoned /dev/shm. Instead, the malware now resides directly on disk and uses a hardcoded process name to mimic legitimate system daemons. This shift reflects a strategic adaptation: blending into normal system behavior rather than avoiding the filesystem entirely.
Variant Breakdown: httpShell vs icmpShell
Recent analysis reveals two primary BPFDoor variants: httpShell and icmpShell, each designed for different operational environments.
httpShell: Precision Through Encapsulation
The httpShell variant leverages kernel-level packet filtering to inspect both IPv4 and IPv6 traffic. It uses HTTP tunneling to extract commands and introduces a new concept known as the Hidden IP (HIP) field.
One of its most notable capabilities is kernel-level decapsulation. By binding to all network interfaces, the malware forces the host kernel to unpack complex tunneling protocols like GRE or GTP. This allows embedded “magic bytes” to be detected deep within packet structures.
To bypass enterprise proxies and web application firewalls, attackers use a clever padding technique. They ensure a specific marker (9999) always appears at the 26th byte offset, regardless of header modifications. This consistency enables reliable triggering even in heavily filtered environments.
However, the implementation has limitations. The malware assumes a fixed IPv6 header size of 40 bytes. If extension headers are present, the payload shifts, causing the backdoor to fail to activate.
icmpShell: Covert Communication Over ICMP
The icmpShell variant is engineered for highly restricted environments where traditional communication channels are blocked. It tunnels interactive shell sessions entirely over ICMP.
A key innovation is PID-bound mutation. The malware dynamically generates a BPF filter tied to its runtime Process ID. Since the PID changes on each execution, the “magic knock” signature also changes, rendering static firewall rules ineffective.
Additionally, icmpShell supports:
- Bidirectional ICMP tunnels
- UDP and ICMP hole-punching
- RC4 encryption for session data
Communication is structured in a unique way: attacker commands are sent in cleartext prefixed with X:, while responses from the victim are encrypted using RC4 with the key “icmp.”
Notably, the backdoor terminates after 12 seconds of inactivity, highlighting its stealth-focused design.
Stateless Command and Control via Hidden IP
One of BPFDoor’s most sophisticated features is its stateless C2 mechanism. This is achieved using a special flag (255.255.255.255) in the magic packet.
When this flag is set, the malware ignores hardcoded IP addresses and instead sends its reverse shell to the source IP of the triggering packet. This eliminates the need for attackers to embed their infrastructure details, allowing them to operate behind NAT or VPNs without exposure.
ICMP Relay and Lateral Movement
BPFDoor can also act as an invisible router within compromised networks. When authentication fails, the malware extracts an internal IP from the HIP field and forwards crafted ICMP packets to that target.
To prevent infinite loops, it resets the hop IP to -1. This mechanism enables stealthy lateral movement without triggering traditional detection systems.
Emerging Variants and New Capabilities
Rapid7 identified several new BPFDoor variants, each introducing unique capabilities:
- Variant F hides in
/var/run/user/0, avoiding audit logs and bypassing common hardening measures - Implements full file descriptor wiping and timestomping for anti-forensics
- Introduces new magic bytes such as:
udp[8:2] == 0x3182icmp[8:2] == 0x1051tcp[((tcp[12]&0xf0)>>2):2] == 0x3321
Another variant introduces multi-protocol parallel sniffing, creating three raw sockets:
- TCP:
socket(AF_INET, SOCK_RAW, IPPROTO_TCP) - UDP:
socket(AF_INET, SOCK_RAW, IPPROTO_UDP) - ICMP:
socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)
This design ensures redundancy. If one protocol is blocked, attackers can switch to another without reconfiguring the malware.
Living Off the Land: Targeted Server Attacks
A particularly advanced variant targets HPE ProLiant servers by impersonating legitimate system processes like cmathreshd. It checks for /var/run/cma.lock, kills the real service, and replaces it.
It also disables security hooks using:
unsetenv("LD_PRELOAD")
This demonstrates deep environmental awareness and suggests targeting of telecom infrastructure.
Active Beaconing and C2 Domains
Unlike earlier passive variants, Variant H introduces active beaconing. It continuously resolves and connects to domains such as:
- ntpussl[.]instanthq.com
- ntpupdate.ddnsgeek[.]com
- ntpupdate.ygto[.]com
- ntpd.casacam[.]net
These domains mimic legitimate services like NTP updates or IoT telemetry, allowing malicious traffic to blend into normal network noise.
The malware connects over port 443 using RC4-MD5 encryption, ensuring compatibility with standard outbound firewall rules.
Detection and Defensive Strategies
Defending against BPFDoor requires shifting focus from payload inspection to structural anomalies:
- Monitor ICMP packets with sequence number 1234
- Detect invalid ICMP Code 1 used in heartbeat traffic
- Track creation of AF_PACKET sockets and BPF filter attachments
- Identify processes with missing executable paths or spoofed names
- Use Rapid7’s triage script to detect active filters and mutex artifacts
Final Thoughts
BPFDoor exemplifies how modern malware evolves through refinement rather than reinvention. Its ability to operate at the kernel level, adapt to network defenses, and maintain stealth through protocol abuse makes it particularly dangerous.
Our Opinion on the BPFDoor Case
The continued evolution of BPFDoor highlights a broader shift in attacker mindset—from noisy exploitation toward precision-driven persistence. What makes this malware especially concerning is not just its technical sophistication, but its operational discipline. The threat actors behind BPFDoor are clearly optimizing for long-term access rather than immediate impact, which aligns closely with espionage-driven campaigns.
The introduction of stateless C2 via the “Hidden IP” field is particularly noteworthy. It removes one of the biggest operational risks for attackers: infrastructure exposure. Combined with ICMP-based tunneling and multi-protocol fallback mechanisms, this creates a highly resilient command-and-control architecture that is difficult to disrupt without deep network visibility.
Equally important is the malware’s awareness of enterprise environments. Features like process masquerading, audit log evasion, and targeted server abuse suggest attackers are tailoring deployments to specific infrastructures rather than using generic payloads.
From a defensive standpoint, this case reinforces the need to move beyond signature-based detection. Organizations must invest in behavioral monitoring, kernel-level telemetry, and anomaly detection at the protocol level. Without these capabilities, threats like BPFDoor will continue to operate undetected for extended periods.
