SMTP is the key: BPFDoor and AVERAT hitting the network edge

MITRE Techniques

• [T1584.008 ] Compromise Infrastructure: Network Devices – The operators used compromised NAS, DVR, and other edge devices as relays and footholds (‘consumer and small-business broadband CPE’).
• [T1133 ] External Remote Services – AVERAT relays exposed PPTP on 1723 and were used as inbound access paths (‘PPTP on 1723, present on all three’).
• [T1480 ] Execution Guardrails – The dropper executed only if /tmp/flag existed and the .php script was absent (‘Execution is gated on one precondition’).
• [T1059.004 ] Unix Shell – The dropper and implant used shell commands and scripts to stage and launch payloads (‘#!/bin/sh’, ‘sh -c’).
• [T1129 ] Shared Modules – AVERAT could load or unload shared-object modules to extend functionality (‘Load or unload a shared-object module’).
• [T1037 ] Boot or Logon Initialization Scripts – The dropper relied on package/startup behavior to relaunch on boot (‘package startup very likely relaunches it at boot’).
• [T1205 ] Traffic Signaling – BPFDoor used magic packets and HTTP-tunneled triggers for covert activation (‘magic packet’, ‘HTTPS POST tunneling mode’).
• [T1205.002 ] Traffic Signaling: Socket Filters – BPFDoor and Rekoobe used classic BPF filters to detect magic traffic (‘attaching a classic BPF filter’).
• [T1070.004 ] File Deletion – The dropper removed staged binaries and scripts after execution (‘rm -rf /sbin/ntpdate’).
• [T1070.003 ] Clear Command History – AVERAT suppressed bash/vim logging to hide operator activity (‘not logged to bash history nor to vim logs’).
• [T1070.006 ] Timestomp – BPFDoor-related behavior included misleading timing/cleanup patterns and deleted artifacts to obscure activity (‘delete each file ten seconds later’).
• [T1036.004 ] Masquerade Task or Service – BPFDoor spoofed service names and process identities (‘spoofs the identity of /usr/sbin/abrtd’).
• [T1036.005 ] Match Legitimate Name or Location – The samples used legitimate-looking names and paths such as ntpdate, udevds, and service paths (‘blend into the software and device conventions’).
• [T1564.001 ] Hidden Files and Directories – AVERAT used hidden state files such as /var/lib/.db and other dotfiles (‘persistent across restarts’).
• [T1027 ] Obfuscated Files or Information – BPFDoor and AVERAT hid strings and configuration with encoding, XOR, and encrypted blobs (‘Strings are hidden’, ‘encrypted blob’).
• [T1027.013 ] Encrypted/Encoded File – The dropper and AVERAT stored payload/configuration in AES- and RC4-protected blobs (‘AES-128-ECB blobs’, ‘276-byte encrypted blob’).
• [T1140 ] Deobfuscate/Decode Files or Information – The article describes decoding hidden strings and decrypting configuration to reveal paths, keys, and commands (‘Decoding reveals’).
• [T1562.004 ] Disable or Modify System Firewall – BPFDoor used NAT redirection and firewall-aware techniques to bypass inspection (‘iptables NAT-redirect staging/teardown logic’).
• [T1083 ] File and Directory Discovery – AVERAT enumerated directory contents and walked file trees (‘Enumerate directory contents’).
• [T1057 ] Process Discovery – AVERAT enumerated running processes with command lines (‘Enumerate running processes with command lines’).
• [T1082 ] System Information Discovery – AVERAT collected hostname, OS version, and other system details (‘report hostname, current user, OS version’).
• [T1033 ] System Owner/User Discovery – AVERAT reported the current user and logged-in users (‘current user’, ‘logged-in users’).
• [T1016 ] System Network Configuration Discovery – AVERAT collected network interfaces as part of beaconing (‘network interfaces’).
• [T1005 ] Data from Local System – The dropper staged local files and paths from the appliance filesystem (‘three paths and a script’).
• [T1041 ] Exfiltration Over C2 Channel – AVERAT sent collected host data back through its command channel (‘Each reports hostname…’).
• [T1030 ] Data Transfer Size Limits – AVERAT used chunked uploads and resumable downloads (‘Upload a file…in chunks’, ‘Download…with resume support’).
• [T1105 ] Ingress Tool Transfer – The dropper installed payloads by copying them from /addpkg into /sbin (‘copies AVERAT into /sbin/udevds’).
• [T1071.003 ] Application Layer Protocol: Mail Protocols – AVERAT communicated over SMTP and STARTTLS on port 25 (‘It connects outbound to port 25 and speaks SMTP’).
• [T1573.001 ] Encrypted Channel: Symmetric Cryptography – AVERAT and Rekoobe used TLS and application-layer encryption (‘HMAC-SHA1, AES-CBC’, ‘STARTTLS’).
• [T1090 ] Proxy – AVERAT included proxy and port-forward capabilities (‘Open a proxy or port-forward channel’).
• [T1008 ] Fallback Channels – BPFDoor and related samples used alternative trigger modes and networking paths (‘ICMP mode’, ‘UDP mode’, ‘HTTPS POST tunneling mode’).
• [T1529 ] System Shutdown/Reboot – AVERAT could reboot the appliance after syncing buffers (‘sync() before forcing a restart’).
• [T1489 ] Service Stop – The reboot and teardown behavior could stop services and flush state (‘forcing a restart through the kernel’).