Red Menshen

Summary

China-nexus espionage group known for BPFDoor, a stealth Linux backdoor that abuses Berkeley Packet Filter functionality to inspect traffic inside the kernel and wakes only on a crafted trigger packet (T1205.002), then opens a reverse shell (T1059.004). Trend Micro, which tracks it as Earth Bluecrow, attributed a previously unseen BPFDoor controller to it with medium confidence in April 2025, from 2024 attacks on telecommunications, finance and retail organisations in South Korea, Hong Kong, Myanmar, Malaysia and Egypt; BPFDoor's source code leaked in 2022, so the backdoor alone does not identify the group. In March 2026 Rapid7 described a long-term, ongoing operation placing BPFDoor "sleeper cells" in telecommunications networks, positioned beside subscriber data and signalling, with government networks among the espionage targets. Sophos CTU tracks it as BRONZE SIESTA, with activity across Asia and the Middle East. active_since is the earliest dated attack in this record (2024), not the group's origin.

Attribution

Vendor assessments (Rapid7, Sophos CTU); no state body named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Rapid7 Labs (Research, 2026-03-26)
  A China-nexus threat actor
• Sophos CTU (Research, 2026-10)
  A China-nexus APT group

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 2

Malware and tools 1

Infrastructure patterns

• BPFDoor controllers run from compromised routers, external systems or inside the victim network (Rapid7, 2026)
• ICMP relays pass commands between infected hosts without classic C2 traffic (Rapid7, 2026)

Reporting and advisories 3

• Trend Micro
  BPFDoor's hidden controller used against Asia, Middle East targets (Apr 2025)
• Rapid7 Labs
  BPFdoor in telecom networks: sleeper cells in the backbone (Mar 2026)
• Sophos CTU
  BRONZE SIESTA threat profile