New Stealthy Variant of Linux Backdoor BPFDoor Emerges from the Shadows

New variant of Linux backdoor BPFDoor, aka JustForFun, is extremely stealthy and hard to detect. Associated with Red Menshen threat actor targeting telecom providers in the Middle East and Asia. Uses BPF for network communications and process commands to establish persistent remote access, evade firewalls and filter unnecessary data. Latest version removes hard-coded indicators, includes libtomcrypt for encryption, and a reverse shell for C2 communication