MALWARE FAMILY

BPFDoor

Internal ID: elf.bpfdoor

aliases

Last seen:Mar 17, 2026

Intelligence Profile

BPFDoor is a passive backdoor used by a China-based threat actor. This backdoor supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP allowing the threat actor a variety of mechanisms to interact with the implant.

Threat Analysis

BPFDoor is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor

→https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

→https://elastic.github.io/security-research/intelligence/2022/05/04.bpfdoor/article/#

→https://en.yna.co.kr/view/AEN20250526002700320

→https://exatrack.com/public/Tricephalic_Hellkeeper.pdf

→https://haxrob.net/bpfdoor-past-and-present-part-1/

→https://haxrob.net/bpfdoor-past-and-present-part-2/

→https://lolcads.github.io/posts/2023/12/bpf_memory_forensics_with_volatility3/

→https://nikhilh-20.github.io/blog/cbpf_bpfdoor/

→https://troopers.de/troopers22/talks/7cv8pz/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.bpfdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BPFDoor