• Rapid7 Labs reported a sustained espionage campaign by a China-nexus threat actor, Red Menshen, involving long-term dormant footholds inside global telecommunications networks.
• The activity described includes use of a Linux kernel-level backdoor (BPFdoor) designed to avoid opening ports and to limit conventional endpoint and network monitoring visibility.
• A newly identified malware variant was found to conceal command triggers within legitimate encrypted HTTPS traffic, including abuse of SSL termination points such as load balancers and proxies.
• The investigation also described targeting of telecommunications signaling protocols such as SCTP, enabling visibility into subscriber activity across 4G and 5G networks.
• Rapid7 released an open-source scanning script intended to detect previously documented BPFdoor variants and newer samples.

Disclaimer: This news brief was created by Public Technologies (PUBT) using generative artificial intelligence. While PUBT strives to provide accurate and timely information, this AI-generated content is for informational purposes only and should not be interpreted as financial, investment, or legal advice. Rapid7 Inc. published the original content used to generate this news brief on March 26, 2026, and is solely responsible for the information contained therein.