SMTP Is the Key: BPFDoor and AVERAT Hitting the Network Edge
Rapid7, Friday, October 2nd, 2026
Rapid7 analyzes a new BPFDoor variant, a BPF Rekoobe build and the AVERAT Linux implant targeting telecom and edge devices.
Rapid7 Intelligence tracked Linux malware samples designed to blend into the software and device conventions of telecom environments.
The set includes a newly observed BPFDoor variant, a BPF Rekoobe build used against South Korean targets, a dropper, and six builds of a Linux implant Rapid7 tracks as AVERAT, deployed against Taiwanese appliances.
The report also publishes source code details of the Rapid7 BPFDoor controller introduced in an April 2026 post.