The Forensics Way

Front Page

State-Sponsored Espionage

Sleeper Cells in the Backbone: China's Red Menshen Pre-Positioned BPFdoor Inside Global Telecom Networks

Rapid7 Labs confirmed on March 26 that Chinese state-nexus group Red Menshen has spent years systematically embedding BPFdoor implants inside telecommunications backbone infrastructure worldwide — not for immediate data theft, but as dormant sleeper cells that can be activated on command for espionage or large-scale disruption.

BPFdoor abuses the Linux kernel's BPF subsystem to inspect raw packets, awakening only on a trigger buried in normal HTTPS traffic — exposing no listening ports and generating zero C2 traffic at rest. Rapid7 released a free detection script; investigators must hunt for raw socket usage, anomalous BPF filter installations, and process spoofing artifacts on all Linux network edge hosts.

Supply Chain Escalation

CanisterWorm Goes Ransomware: TeamPCP Pivots to Vect RaaS After Stealing 300 GB of Developer Credentials

The TeamPCP CanisterWorm campaign escalated dramatically this week as the group partnered with Vect ransomware-as-a-service and confirmed first ransomware deployments using 300 GB of stolen CI/CD credentials harvested from 474 compromised GitHub repositories and 1,750 Python packages.

Within eight days, TeamPCP expanded targeting from Linux to Windows, pivoted delivery from Base64 inline encoding to WAV steganography, and extended the blast radius to Checkmarx, LiteLLM, and Telnyx SDK. Any organization that consumed affected packages must treat downstream endpoint compromise — not just credential exposure — as a live incident.

Threat Bulletin

ACTIVE EXPLOIT
CVE-2025-53521

F5 BIG-IP APM — Unauthenticated RCE triggered by malicious traffic when an APM access policy is active; CVSS 9.3. Added to CISA KEV March 27; federal patch deadline March 30. Forensic Note: BIG-IP APM sits at the auth perimeter — audit all systems that authenticated through the affected appliance for lateral movement.

CRITICAL
CVE-2026-21643

Fortinet FortiClient EMS — Pre-auth SQL injection via unsanitized tenant header extracts full admin credentials from the PostgreSQL backend; CVSS 9.8. 2,000+ exposed instances tracked by Shadowserver. Forensic Note: Audit EMS policy deployment chains and endpoint telemetry for unauthorized policy changes.

Malware Spotlight

Infiniti Stealer (ClickFix)

Python-based macOS infostealer delivered via Cloudflare-branded fake browser verification prompts using Bash one-liners — the ClickFix technique — that bypass Gatekeeper assumptions. Targets credentials, browser data, and crypto wallets. Forensic Note: No traditional binary footprint; detection requires user-behavior telemetry and script-execution monitoring.

The First State Cyber Espionage Campaign — Russia's Multi-Year Infiltration of US Military Networks

From 1996 to 1999, Russian state actors systematically exfiltrated terabytes from US military, NASA, and DoE networks in what became the first publicly attributed state-sponsored cyber espionage campaign — Moonlight Maze. Investigators traced the attack through telephone records and sustained international cooperation, establishing the attribution framework still applied in state-nexus telecom cases like BPFdoor today.

The Mandiant Report That Named Names: How China's PLA Stole Terabytes From 141 US Organizations

In February 2013, Mandiant publicly attributed years of systematic IP theft to China's PLA Unit 61398 — designating them APT1. The Comment Crew maintained persistent access to 141 US organizations across 20 industries for an average of 356 days per victim, stealing terabytes of intellectual property. The report pioneered the modern threat-actor attribution methodology that every state-nexus investigation now follows.

SUNBURST: The Supply Chain Attack That Reached 18,000 Organizations

In December 2020, state-sponsored attackers embedded a backdoor called SUNBURST into SolarWinds Orion software updates, compromising 18,000 organizations including nine US federal agencies. The malware lay dormant for two weeks before activation, communicating via DNS beaconing that mimicked legitimate Orion traffic. Its discovery forced investigators to develop new methodologies to distinguish compromised telemetry from authentic network data.

One Compromised Password Shut Down 45% of US East Coast Fuel Supply

The DarkSide ransomware attack on Colonial Pipeline in May 2021 forced a six-day shutdown of 5,500 miles of fuel pipeline serving 45% of the US East Coast. Attackers gained initial access via a single compromised VPN credential with no MFA enforced — the account had not been used in months but remained active. The incident became the primary basis for CISA's OT/ICS network segmentation guidance and defined critical infrastructure IR planning for years.

State-Sponsored Espionage

Sleeper Cells in the Backbone: China's Red Menshen Pre-Positioned BPFdoor Inside Global Telecom Networks

Supply Chain Escalation

CanisterWorm Goes Ransomware: TeamPCP Pivots to Vect RaaS After Stealing 300 GB of Developer Credentials

Threat Bulletin

Malware Spotlight

The Forensics Way

Moonlight Maze (1996–1999)

The First State Cyber Espionage Campaign — Russia's Multi-Year Infiltration of US Military Networks

Operation APT1 / Comment Crew (2006–2013)

The Mandiant Report That Named Names: How China's PLA Stole Terabytes From 141 US Organizations

SolarWinds Orion Supply Chain (2020)

SUNBURST: The Supply Chain Attack That Reached 18,000 Organizations

Colonial Pipeline Ransomware (2021)

One Compromised Password Shut Down 45% of US East Coast Fuel Supply

MalHunt

Rapid7 BPFdoor Detector

NIST OpenLQM

Magnet One Mobile Case Stream