China-Linked Red Menshen Group Deploys BPFDoor Implants Inside Telecom Networks for Long-Term Government Espionage
China-linked threat actor Red Menshen, also known as Earth Bluecrow, has embedded BPFDoor implants inside telecom networks to conduct long-term espionage against government targets. The stealthy BPF-based malware evades standard detection by passively monitoring traffic and avoiding open network ports, giving the group persistent upstream access to high-value communications.
A sophisticated and ongoing cyber-espionage campaign attributed to a China-nexus threat actor identified as Red Menshen — also tracked by researchers as Earth Bluecrow — has successfully embedded itself within telecommunications infrastructure to conduct sustained surveillance against government networks, according to a report published by The Hacker News.
The campaign leverages BPFDoor, a highly evasive implant that exploits the Linux Berkeley Packet Filter (BPF) subsystem to passively monitor network traffic and receive covert commands without opening traditional network ports. This technique allows the malware to evade conventional firewall detection and remain virtually invisible to standard network monitoring tools, making it exceptionally difficult to detect and remediate.
Red Menshen's strategic targeting of telecom carriers reflects a deliberate methodology: by compromising the network backbone rather than individual government endpoints, the group gains persistent, broad-spectrum access to communications traffic passing through those carriers. This upstream positioning enables collection against a wide array of downstream government and high-value targets without the need to directly breach each one.
The activity is described as long-term and ongoing, suggesting the group has maintained footholds within affected networks for an extended period. Researchers characterize the campaign as consistent with state-directed intelligence collection priorities associated with Chinese cyber operations, which have historically focused on telecommunications, defense contractors, and government ministries across Asia, the Middle East, and beyond.
BPFDoor has been observed in prior Red Menshen operations and represents a hallmark tool of the group. Its passive backdoor architecture — which listens for a specific 'magic packet' to activate — means infected systems generate no outbound connection signatures, severely limiting detection through traffic analysis alone.
Source: https://thehackernews.com/2026/03/china-linked-red-menshen-uses-stealthy.html
SENTINEL: This story means ordinary people can no longer assume their phone calls or messages travel through networks that governments can't quietly tap for years at a time. In the future we're heading toward a world where mass digital eavesdropping becomes the background noise of international power struggles, leaving everyday privacy as collateral damage.
Sources (1)
- [1]China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks(https://thehackernews.com/2026/03/china-linked-red-menshen-uses-stealthy.html)