BPFdoor hides deep inside the OS kernel to target telecoms worldwide

SCM feed for Latest

March 26, 2026 at 6:49 PM

Actively Exploited

Overview

A backdoor known as BPFdoor, linked to Chinese cyber actors, has been discovered operating within the Linux kernel of key telecom servers and Kubernetes pods. First identified in 2021, this backdoor is now posing a significant risk to global telecommunications infrastructure. Researchers found that BPFdoor's stealthy design allows it to evade detection while compromising critical systems. This situation is concerning as it impacts the reliability and security of telecom services worldwide, potentially allowing attackers to intercept communications or disrupt services. Companies in the telecom sector need to be vigilant and take immediate action to secure their systems against this threat.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Linux kernel in telecom servers, Kubernetes pods
Action Required: Companies should review their security protocols, apply the latest kernel patches, and monitor for unusual activity within their systems.
Timeline: Ongoing since 2021

Original Article Summary

China-linked Linux backdoor first spotted in 2021, but now runs inside the kernel of core telecom servers and Kubernetes pods.

Impact

Linux kernel in telecom servers, Kubernetes pods

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since 2021

Remediation

Companies should review their security protocols, apply the latest kernel patches, and monitor for unusual activity within their systems.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Critical.

Read Original Article

Related Coverage

‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems

SecurityWeek

Researchers have discovered a new attack method called 'SymJack' that exploits AI coding agents. By using malicious repositories and deceptive symlinks, attackers can trick these AI systems into installing compromised servers under their control. This allows the attackers to steal sensitive information, disrupt continuous integration pipelines, and inject harmful code into software projects. The implications are significant, especially for companies relying on AI tools for software development, as it exposes them to supply chain attacks that can go unnoticed. Developers and organizations need to be vigilant about the sources of their code and the integrity of the tools they use.

May 27, 2026

GlassWorm Botnet Disrupted

SecurityWeek

Security firms have successfully disrupted the GlassWorm botnet by taking down all four command-and-control channels that the malware relied on. This operation is significant because botnets like GlassWorm can be used by attackers for various malicious activities, such as launching distributed denial-of-service (DDoS) attacks or spreading other malware. By dismantling these C&C channels, researchers have reduced the botnet's ability to control infected devices, which is a win for cybersecurity efforts. This disruption not only impacts the operators of the botnet but also protects potential victims from being exploited. As the threat landscape evolves, ongoing vigilance against such malware remains crucial for both individuals and organizations.

May 27, 2026

Dutch police arrests suspect linked to Ajax football club hack

BleepingComputer

Dutch police have arrested a 35-year-old man in connection with a cyberattack on Ajax Amsterdam, a prominent football club. The hack occurred earlier this year, although specific details about the nature of the attack and the data compromised have not been disclosed. This incident raises concerns about the security measures in place at sports organizations, especially as they handle sensitive information about players, fans, and operations. The arrest is part of ongoing efforts by law enforcement to address cybercrime targeting high-profile entities like sports clubs. As the investigation continues, it serves as a reminder for organizations to strengthen their cybersecurity practices to prevent similar incidents.

May 27, 2026

FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data

SecurityWeek

The FBI has issued a warning about a new tactic being employed by the Silent Ransom Group, which involves sending operatives to law firms to physically insert malicious USB drives into their systems. This method allows hackers to bypass traditional cybersecurity measures, making it easier to steal sensitive data. Law firms are particularly vulnerable due to the confidential information they handle. The FBI's alert emphasizes the importance of employee training and heightened awareness regarding suspicious devices in the workplace. Organizations should review their security protocols to mitigate the risk of such physical infiltration.

May 27, 2026

CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day

SecurityWeek

A recently discovered zero-day vulnerability in the LiteSpeed cPanel plugin has been exploited by attackers to execute scripts with root privileges. This security flaw poses a significant risk to users of LiteSpeed's web server and cPanel, particularly those who have not yet applied the necessary patches. The Cybersecurity and Infrastructure Security Agency (CISA) has urged immediate action to patch this vulnerability, which had been actively exploited before it was resolved last week. Failure to address this issue could leave systems vulnerable to further attacks, potentially compromising sensitive data and system integrity. Users are strongly advised to prioritize updates to safeguard their environments.

May 27, 2026

Cybercriminals increasingly use AI for deepfake-based KYC bypass, report finds

SCM feed for Latest

According to new research from Flashpoint, cybercriminals are increasingly using artificial intelligence to create deepfake technology that can bypass Know Your Customer (KYC) processes. Rather than inventing new AI tools, these threat actors are honing existing technologies to make their attacks more effective. This trend poses a significant risk to financial institutions and companies that rely on KYC protocols to verify customer identities. As deepfakes become more sophisticated, organizations may struggle to differentiate between real and fake identities, leading to potential fraud and security breaches. The report indicates that as these tactics evolve, companies must enhance their verification processes to combat this growing threat.

May 26, 2026