Red MenshenThreat actor
- earth bluecrow
- red dev 18
Since 2021, Red Menshen, a China based threat actor, which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors using a custom backdoor referred as BPFDoor. This threat actor uses a variety of tools in its post-exploitation phase.From MISP Galaxy
Last reported 18 days ago, by The Hacker News3 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Unix Shell”
- T1059.004Unix Shell
“Command and Scripting Interpreter: Unix Shell”
- T1133External Remote Services
“External Remote Services”
- T1195Supply Chain Compromise
“Supply-chain compromise of Trivy vulnerability scanner”
- T1548Abuse Elevation Control Mechanism
“Abuse Elevation Control Mechanism: Setuid and Setgid”
- T1548.001Setuid and Setgid
“Abuse Elevation Control Mechanism: Setuid and Setgid”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“…y iterations were the subject of an extensive analysis by Rapid7 earlier this year, with the activity linked to a threat group dubbed Red Menshen (aka Earth Bluecrow, DecisiveArchitect, and Red Dev 18), which has targeted telecom providers across the Middle East and Asia going al…”
-
Cyber Brief 26-04 - March 2026“China-linked Red Menshen BPFdoor implants targeting telecommunications networks”
-
A peek behind the BPFDoor“PWC attributes this back door to a specific group from China, Red Menshen, and detailed a number of interesting components in a high-level threat research post released last week.”
Indicators in its reports
named in the reports above- 144526d30ae74798…bc297ba0c1b3in 1 report
- 3a1b174f0c19c28f…e3062e49b155in 1 report
- 591198c234416c6c…8308d9127c78in 1 report
- 76bf736b25d5c9aa…b4941ce37925in 1 report
- dc8346bf443b7b45…f90359dcae3ain 1 report
- haldrund[.]pidin 1 report
- kdevrund[.]pidin 1 report
- 74ef6cc38f5a1a80…7195a8eccc56in 1 report
- 07ecb1f2d9ffbd20…f9ca7a26ab6din 1 report
- 93f4262fce8c6b4f…2bcafe4edd1cin 1 report
- 96e906128095dead…cff7f3836bb9in 1 report
- 599ae527f10ddb46…64f85e185683in 1 report
- 2e0aa3da45a0360d…6ed5539e4bdbin 1 report
- f47de978da1dbfc5…1396a1953d72in 1 report
- fd1b20ee5bd42904…edd17ebaf68ain 1 report
- 5faab159397964e6…d8e5980f3bb3in 1 report
- f8a5e735d6e79eb5…8b86e714ea27in 1 report
- 5b2a079690efb5f4…a76ddcb28ee9in 1 report
- 97a546c7d08ad34d…f612a84fb8ccin 1 report
- c80bd1c4a796b4d3…c8c9b279b09cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.