Telecom Networks Targeted by Sophisticated Chinese Hacking Campaign

China-Linked Hackers Deploy Stealth Malware in Global Telecom Networks: Report​

New Delhi, March 27 – A China-linked state-sponsored hacking group has been found embedding highly stealthy malware deep within global telecom infrastructure, raising serious concerns about long-term cyber espionage, according to a report by Rapid7.

Advanced Malware Designed for Long-Term Espionage​

The cybersecurity firm revealed that attackers are using kernel-level implants and passive backdoors that function like “digital sleeper cells,” enabling them to remain undetected while continuously monitoring compromised systems.

These tools allow hackers to maintain persistent access to networks without triggering traditional security alerts. Although no specific advanced persistent threat (APT) group has been officially identified, experts believe the campaign is aimed at high-level intelligence gathering, including surveillance of government and critical communication networks.

Exploiting Major Tech Platforms​

The attackers gained access by exploiting vulnerabilities in widely used systems from major companies, including:

• Cisco
• Fortinet
• VMware
• Palo Alto Networks
• Ivanti

They also targeted web platforms such as Apache Struts, enabling entry into enterprise and telecom networks.

BPFdoor Malware Enables Stealth Access​

A key tool in the campaign is BPFdoor, a Linux-based backdoor that operates within the system kernel. It remains inactive while monitoring network traffic and only activates when it detects a specific hidden signal within data packets, making detection extremely difficult.

Once inside, attackers deploy additional tools such as:

• Credential harvesters
• Keyloggers
• Remote command frameworks

They also use passive backdoors like TinyShell to maintain access even if parts of the intrusion are uncovered.

Targeting Core Telecom Infrastructure​

Rapid7 warned that the campaign is focused on gaining control over core telecom infrastructure, including both traditional systems and modern cloud environments like Kubernetes, widely used in telecom operations.

Newer versions of the malware are even more sophisticated, hiding signals within encrypted web traffic and using multiple evasion techniques to bypass security layers.

Rising Cybersecurity Risks​

Experts caution that such attacks pose significant risks as they target the backbone of communication systems, potentially enabling attackers to:

• Monitor sensitive data flows
• Disrupt telecom services
• Prepare for future cyber operations

The findings highlight growing concerns over cybersecurity threats to global telecom networks and the need for stronger defenses against advanced, state-backed cyber espionage campaigns.