SMTP is the key: BPFDoor and AVERAT hitting the network edge

A sophisticated multi-component malware campaign targets telecommunications and network-edge appliances using BPFDoor variants and a newly identified implant called AVERAT. The attackers exploit SMTP traffic on port 25 to hide command-and-control communications within legitimate mail relay activity. The malware uses memory-only execution to avoid leaving forensic artifacts on disk. BPFDoor variants impersonate legitimate processes on South Korean systems, while AVERAT targets Taiwanese appliances with regional disguises. The operation employs compromised consumer devices as relays, consistent with a China-linked covert network. The campaign demonstrates advanced evasion techniques including process spoofing and encrypted configurations.

• CVE-2026-98432: Linux kernel IPv4 TCP use-after-free IssueHighVulnerability2026-10-31
• Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxExploitedVulnerability2026-10-30
• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• Aurora ransomware targets ESXi abuses Cursor Agent for exploitationMalware2026-10-29
• ZDI-26-834: Linux Kernel IPv6 AH Routing Header Integer Underflow Local Privilege Escalation VulnerabilityHighVulnerability2026-10-29