A China-linked state-sponsored threat actor has deployed kernel implants and passive backdoors deep within telecommunication backbone infrastructure worldwide for long-term persistence, Rapid7 reports.
The stealth digital sleeper cells have not been attributed to any known APT but are meant for high-level espionage, including against government networks, the cybersecurity firm says.
The persistent tools were deployed as part of apparent discreet breaches that are characterized by recurring elements, suggesting an ongoing operation aimed at “embedding stealthy access mechanisms deep inside telecom and critical environments” for extended access.
As part of its investigation, Rapid7 uncovered passive backdoors and kernel-level implants that have been used in combination with credential harvesters and cross-platform command frameworks.
“Together, these components form a persistent access layer designed not simply to breach networks, but to inhabit them,” the cybersecurity firm warns.
One of the central pieces of the campaign is BPFdoor, a stealthy Linux backdoor that was publicly detailed in 2021, and which uses Berkeley Packet Filter (BPF) functionality for packet inspection within the kernel, reacting to specific packets only.
As part of the analyzed intrusions, public-facing applications and valid accounts were abused for initial access. The state-sponsored hackers targeted Ivanti, Cisco, Fortinet, VMware, and Palo Alto Networks appliances, as well as Apache Struts and other web-facing platforms.
At the next step, the hackers deployed Linux beacon frameworks such as CrossC2, a Cobalt Strike-derived beacon often used by Chinese APTs for staging, command execution, and lateral movement.
For persistence, the intruders often deploy the open source passive backdoor framework TinyShell. SSH brute-forcers and custom keyloggers are also deployed, along with “brute-force utilities containing pre-populated credential lists tailored for telecom environment,” Rapid7 says.
The BPFDoor, which had its source code leaked online in 2022, is deployed in the Linux kernel and remains dormant, inspecting network traffic using the BPF filter. When a specific magic byte sequence is received inside a crafted packet, the backdoor spawns a bind shell or reverse shell.
Rapid7 observed several BPFdoor samples used in the wild, all ELF files, although Solaris variants also exist, and released a scanner to help defenders identify potential infections.
Some BPFdoor samples, the cybersecurity firm says, can mimic bare-metal infrastructure, posing as legitimate enterprise platforms to blend into operational noise. Others were seen spoofing core containerization components.
In newer variants, the backdoor trigger is embedded within seemingly legitimate HTTPS traffic, and the attackers are carefully padding the request so that their marker always “lands exactly at the 26th byte offset of the inspected data structure,” which the implant checks.
“The updated variant combines encrypted HTTPS triggers, proxy-aware command delivery, application-layer camouflage techniques, ICMP-based control signals, and kernel-level packet filtering to bypass multiple layers of modern network defenses,” Rapid7 notes.
The cybersecurity firm underlines that BPFdoor’s capabilities make it more threatening than a typical, stealthy backdoor, turning it into an access layer to telecom backbone infrastructure.
“Rather than targeting individual servers, the operators appear to focus on the underlying platforms that power modern telecommunication networks: bare-metal systems running telecom workloads, cloud-native Kubernetes environments hosting Containerized Network Functions, and the signaling protocols that coordinate subscriber identity, mobility, and communication flows,” Rapid7 notes.
This is not the first time Chinese hackers have been caught deep inside critical infrastructure. In early 2024, CISA confirmed that Volt Typhoon had been “pre-positioning” across US organizations, only months after Mandiant warned of the hacking group being “clearly dug in”.
In 2024, the networks of nine US telecom firms were hacked by Salt Typhoon, a Chinese state-sponsored group that continued targeting telecoms providers in 2025.
Related: FCC Bans New Routers Made Outside the US Over National Security Risks
Related: EU Sanctions Chinese, Iranian Firms Supporting Hacking Operations
Related: Google Disrupts Chinese Hackers Targeting Telecoms, Governments
Related: Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms
