Full Report
Trend Micro uncovered a previously unseen controller used in BPFDoor campaigns, attributing it to Earth Bluecrow (also known as Red Menshen), a state-sponsored APT group. BPFDoor is a stealthy Linux backdoor leveraging Berkeley Packet Filtering (BPF) to silently activate via "...
Analysis Summary
# Threat Actor: Earth Bluecrow (Red Menshen)
## Attribution & Identity
* **Identification:** State-sponsored APT group.
* **Known Aliases:** Red Menshen.
* **Associated Groups:** Earth Bluecrow.
## Activity Summary
Trend Micro recently uncovered a previously unseen controller associated with their ongoing BPFDoor campaigns. These campaigns aim for cyberespionage and utilize the stealthy BPFDoor Linux backdoor for long-term persistence.
## Tactics, Techniques & Procedures
* **Malware Use:** Deployment of the BPFDoor Linux backdoor.
* **Evasion/Activation:** Leveraging Berkeley Packet Filtering (BPF) to silently activate via "magic packets," bypassing firewalls.
* **Network Capabilities:** Support for reverse shells and port redirection.
* **Persistence/Stealth:** Ability to adapt magic byte sequences and disable shell history logging.
* **Lateral Movement:** Observed capabilities for network lateral movement.
* **Communication:** Encrypted communication over TCP, UDP, and ICMP protocols.
* **Authentication:** Command-and-control authentication secured by a salted MD5 password check.
## Targeting
* **Sectors:** Telecommunications, Financial, and Retail sectors.
* **Geography:** South Korea, Malaysia, Myanmar, Egypt, and Hong Kong (AMEA focus).
* **Victims:** Not specified beyond the targeted sectors.
## Tools & Infrastructure
* **Malware Families Used:** BPFDoor (Advanced Linux backdoor).
* **Infrastructure:** Controller supports reverse shell functionality and encrypted C2 communication. (No specific IPs/Domains provided in the context).
## Implications
Earth Bluecrow utilizes highly stealthy, kernel-level techniques (BPF) to maintain long-term, low-detection persistence on targeted Linux infrastructure. Their focus on critical regional sectors (Telecom, Finance) suggests intelligence gathering and strategic disruption objectives.
## Mitigations
* Monitor network traffic for unusual "magic packet" activity that might trigger BPF-level code execution on Linux hosts.
* Implement robust endpoint detection and response (EDR) capabilities specifically tuned for kernel-level/BPF manipulation.
* Scrutinize all anomalous reverse shell connections and network lateral movement attempts.
* Review configurations for shell history logging to ensure continuous logging is enforced.