SMTP is the key: BPFDoor and AVERAT hitting the network edge A sophisticated multi-component campaign targeting telecommunications and network-edge appliances has been discovered, featuring BPFDoor variants and a newly identified implant designated AVERAT. The operation leverages SMTP traffic on port 25 to blend command-and-control communications with legitimate mail relay activity, exploiting the trust environments of targeted systems. Attackers deploy a dropper that stages payloads into memory-only execution, leaving no on-disk artifacts for forensic analysis. BPFDoor variants impersonate legitimate processes such as SpamSniper components on South Korean systems, while AVERAT samples target Taiwanese appliances using regionalized disguises. The infrastructure relies on compromised consumer devices including NAS units, CCTV systems, and DVRs as operational relays, consistent with China-nexus covert network patterns. Each component demonstrates advanced operational security through process spoofing, encrypted configurations, and deliberate evasion of network monitor... Pulse ID: 6abfb61b65922c3229d35cf8 Pulse Link: https://otx.alienvault.com/pulse/6abfb61b65922c3229d35cf8 Pulse Author: AlienVault Created: 2026-10-02 13:48:11 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #Edge #Deploy #China #OTX #AlienVault