Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
SMTP is the key: BPFDoor and AVERAT hitting the network edge
Malware Families
Excerpt
Overview Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT , deployed against Taiwanese appliances. Additionally, we provide source code details of the Rapid7 BPFDoor controller introduced in our April 2026 blog, Stealthy BPFDoor…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f | High | Score 86/100 | First seen |
| SHA256 | 4925bcca085ec504f51191645da278d8e96698d91f3c6df44146336c697b4de8 | Medium | Score 53/100 | First seen |
| SHA256 | a65048eb30661e27f8edc2dd8d8c77ec87faec1f1750f6e04e7ecaf069a32858 | High | Score 86/100 | First seen |
| SHA256 | 2fe2dd402ee6f9c578fce6dd4b36daaa407e99133e5dd502f2afca80feb60150 | Medium | Score 53/100 | First seen |
| SHA256 | 7e667ba5f9df912e02275d3cfe3809d16f822fe776f4035c84b118ebd925b1b5 | High | Score 86/100 | First seen |
| SHA256 | bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47 | High | Score 86/100 | First seen |
| SHA256 | a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a | Medium | Score 53/100 | First seen |
| SHA256 | a4379e115d3c4420f5d4b92561022d6e0897990e7297be65c033d47de68e6a6a | Medium | Score 53/100 | First seen |
| SHA256 | 925c041807d4fb9dfe2ad84f963c2a4c60ea1289f6a0bdccbfb944478ffc2cf2 | Medium | Score 53/100 | First seen |
| SHA256 | a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3 | High | Score 86/100 | First seen |
| SHA256 | 4435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9 | High | Score 86/100 | First seen |
| SHA256 | 2bedc26d4b29b435c21962beed7db21188a0219a0d28334bba8b4fb1656d7b15 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…