Threat intelligence / Malware

BPFDoor

[BPFDoor](https://attack.mitre.org/software/S1161) is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, [BPFDoor](https://attack.mitre.org/software/S1161) is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. [BPFDoor](https://attack.mitre.org/software/S1161) supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.(Citation: Sandfly BPFDoor 2022)(Citation: Deep Instinct BPFDoor 2023)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BPFDoor](https://attack.mitre.org/software/S1161) is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, [BPFDoor](https://attack.mitre.org/software/S1161) is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. [BPFDoor](https://attack.mitre.org/software/S1161) supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.(Citation: Sandfly BPFDoor 2022)(Citation: Deep Instinct BPFDoor 2023)

Labels

malware

13 recorded

Relationships

uses

to Break Process Trees

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Execution Guardrails

Technique

uses

to File Deletion

Technique

uses

to Ignore Process Interrupts

Technique

uses

to Indicator Removal

Technique

uses

to Mutual Exclusion

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Overwrite Process Arguments

Technique

uses

to Prevent Command History Logging

Technique

uses

to Socket Filters

Technique

uses

Technique

uses

Technique

8 external

References

mitre-attack

S1161

Harries JustForFun 2022

https://www.crowdstrike.com/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/

JustForFun

—

Backdoor.Solaris.BPFDOOR.ZAJE

—

Backdoor.Linux.BPFDOOR

—

Merces BPFDOOR 2023

https://www.trendmicro.com/en_us/research/23/g/detecting-bpfdoor-backdoor-variants-abusing-bpf-filters.html

Deep Instinct BPFDoor 2023

https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game

Sandfly BPFDoor 2022

https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/