MITRE ATT&CKsoftware (malware)
S1161 BPFDoor
- Domain
- enterprise
- Platforms
- Linux
- Aliases
- JustForFun, Backdoor.Linux.BPFDOOR, Backdoor.Solaris.BPFDOOR.ZAJE
- Version
- 1.1
- Created
- 2024-09-20
Description
BPFDoor is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, BPFDoor is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. BPFDoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.
Related
Uses · MITRE ATT&CK (13)
- T1686 Disable or Modify System Firewall technique
- T1690 Prevent Command History Logging technique
- T1036.011 Overwrite Process Arguments sub-technique
- T1480.002 Mutual Exclusion sub-technique
- T1036.009 Break Process Trees sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1205.002 Socket Filters sub-technique
- T1059.004 Unix Shell sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1480 Execution Guardrails technique
- T1027 Obfuscated Files or Information technique
- T1070 Indicator Removal technique
References
- https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/ Harries JustForFun 2022
- https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html Merces BPFDOOR 2023
- https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game Deep Instinct BPFDoor 2023
- https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/ Sandfly BPFDoor 2022