BPFDoor
BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.[1][2]
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1036 | .004 | 伪装: Masquerade Task or Service |
BPFDoor overwrites the |
| .009 | 伪装: Break Process Trees |
After initial execution, BPFDoor forks itself and runs the fork with the |
||
| Enterprise | T1059 | .004 | 命令与脚本解释器: Unix Shell |
BPFDoor can create a reverse shell and supports vt100 emulator formatting.[1] |
| Enterprise | T1562 | .003 | 妨碍防御: Impair Command History Logging |
BPFDoor sets the |
| .004 | 妨碍防御: Disable or Modify System Firewall |
BPFDoor starts a shell on a high TCP port starting at 42391 up to 43391, then changes the local |
||
| Enterprise | T1480 | 执行保护 |
BPFDoor creates a zero byte PID file at |
|
| Enterprise | T1205 | .002 | 流量激活: Socket Filters |
BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its "magic" bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.[1][2] |
| Enterprise | T1027 | 混淆文件或信息 |
BPFDoor can require a password to activate the backdoor and uses RC4 encryption or static library encryption |
|
| Enterprise | T1070 | 移除指标 |
BPFDoor clears the file location |
|
| .004 | File Deletion |
After initial setup, BPFDoor's original execution process deletes the dropped binary and exits.[1] |
||
| .006 | Timestomp |
BPFDoor uses the |
||
| Enterprise | T1564 | .011 | 隐藏伪装: Ignore Process Interrupts |
BPFDoor set's it's process to ignore the following signals; |