GajShield Threat Advisory — AVERAT / BPFDoor / Rekoobe Linux Backdoor Campaign

Severity: HIGH | Priority: P1

GajIPS signatures  detect a combined campaign in which Linux-targeted backdoors — AVERAT, BPFDoor, and Rekoobe/SpamSniper — are deployed together on compromised network edge appliances, including NAS devices, SMB network storage, and IP video recorders. AVERAT is a Linux backdoor that disguises its command-and-control traffic as SMTP email relay communications, connecting outbound to attacker-controlled domains that are named to resemble legitimate mail infrastructure (mx.zxopfds.com, spam.suwaccqi.com, mx1.wwstifsteel.com). The C2 traffic blends with normal outbound email flow and would appear as routine SMTP relaying to a network monitor that does not inspect DNS resolution or TLS SNI. . BPFDoor is a well-known Linux backdoor, attributed to Chinese espionage operations, that installs a Berkeley Packet Filter on the compromised host to monitor all inbound packets at the kernel level, before the host's own firewall rules evaluate them; it can therefore receive its activation payload on any port, including ports that appear closed to a port scanner. Rekoobe and SpamSniper are backdoor implants that BPFDoor or AVERAT may stage on a newly activated host to provide an interactive command channel. All three backdoor families have been found together on the same compromised devices in this campaign, suggesting the attacker installs them in combination to provide redundant persistence.

If any rule in this set fires on your network, treat the alert as a high-confidence indicator of an active implant on a Linux host at the alerting IP address. The AVERAT rules  indicate an infected host is attempting to reach the C2 infrastructure, likely already past the installation stage. The BPFDoor magic rule firing on a destination host means that host may have received an activation command and should be assumed to have an active BPFDoor presence; standard process listings and netstat will not reveal BPFDoor because it hides itself using /proc manipulation and does not bind a listening port. To confirm BPFDoor on a suspect host, look for a process whose /proc/<pid>/exe link is deleted (typical of BPFDoor's self-deletion of its binary on disk after launch), examine loaded BPF programs with bpftool prog list or ss --bpf on kernel 4.15+, and check for unusual raw socket file descriptors in /proc/<pid>/fd. Rekoobe detection indicates an attacker is actively issuing commands through an already-established session; response must be treated as a live intrusion. For all confirmed detections, isolate the host at the network layer before beginning forensic investigation, as BPFDoor and Rekoobe both support file upload, download, and shell command execution, and data exfiltration may be ongoing.