APT / THREAT GROUP

BPFDoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.

Threat Analysis

BPFDoor is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning BPFDoor

China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks

The Hacker News· Mar 26, 2026

External References

→https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor

→https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

→https://elastic.github.io/security-research/intelligence/2022/05/04.bpfdoor/article/#

→https://en.yna.co.kr/view/AEN20250526002700320

→https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

JustForFunelf.bpfdoorBPFDoor

External Intelligence

Malpedia: elf.bpfdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BPFDoor