AVERAT Malware Hides in Email Security Appliances, Uses SMTP

A mail security gateway talks SMTP on port 25 to strangers all day. That is its job. Rapid7 has now documented malware built around that fact: a Linux implant that phones home over port 25 from the one box on the network where an outbound SMTP session to an unfamiliar server raises no questions.

The Rapid7 report covers two campaigns. In Taiwan, a dropper installs an implant Rapid7 tracks as AVERAT. In South Korea, new BPFDoor and Rekoobe builds borrow the file and process names of SpamSniper, a Korean antispam product. The Hacker News picked the research up on October 6 and described AVERAT as "previously unreported."

Key Takeaways

• AVERAT is a modular Linux implant that Rapid7 found in six builds, deployed against Taiwanese appliances by a dropper whose AES key is derived from the string ShareTech.
• AVERAT connects outbound on TCP port 25, sends EHLO and STARTTLS, then checks in every 600 to 699 seconds, which works out to at most 144 routine check ins a day.
• BPFDoor variants in the South Korean cluster use /var/run/spamsniper.pid as a mutex and rotate through ten Linux daemon names, while a Rekoobe build wakes only for packets whose source and destination ports both equal 25.
• Rapid7 names no threat group in this report and found no overlap between AVERAT's relay infrastructure and any named ORB network.
• Mandiant documented the same design in 2023: SEASPY, a backdoor on Barracuda Email Security Gateway appliances, filtered TCP ports 25 and 587 for a magic packet and was installed as BarracudaMailService.

What Is AVERAT?

AVERAT is a modular Linux implant, found by Rapid7 in six builds, that a dropper installs on appliances in Taiwan and that takes its orders over SMTP. Rapid7 heads the relevant section "A dropper likely built for ShareTech appliances" and names no model. ShareTech is a Taiwanese vendor whose product pages list firewalls and mail servers.

The dropper is an x86-64 ELF with no networking code, which the report calls "a local installer, run after access is already established." It sits at /addpkg/sbin/update, inside what Rapid7 identifies as the appliance's own directory for add on packages, and decrypts its contents with an AES-128 key taken from the first sixteen bytes of SHA1("ShareTech").

What it decrypts is a shell script saved with a .php extension. The script copies two binaries into /sbin as ntpdate and udevds, starts each one, waits ten seconds and deletes the file. udevds is AVERAT. ntpdate is the dropper again, now running as a watchdog that rewrites the script whenever it disappears.

Both processes keep running with no file behind them. In Rapid7's words, "there is nothing to hash, quarantine or submit." The dropper has no persistence code. Rapid7's explanation is that the firmware's package startup "very likely relaunches it at boot" from the add on directory.

How Does AVERAT Use SMTP for Command and Control?

AVERAT opens an outbound connection to TCP port 25, sends EHLO, requests STARTTLS and only then starts its own encrypted session. On a mail gateway, every legitimate delivery begins the same way. Rapid7 says the traffic is "indistinguishable from legitimate work in flow records." MITRE ATT&CK catalogs the approach as T1071.003, Mail Protocols.

The TLS layer is hand built instead of linked from a standard library: a fixed ClientHello with a 40 entry cipher suite list is compiled into the binary, and the two ends authenticate afterwards with a shared secret.

Check ins arrive every 600 to 699 seconds and report hostname, current user, OS version, network interfaces and logged in users. That is one SMTP session roughly every ten to twelve minutes, at most 144 a day. The interval is stored in a hidden file, /var/lib/.db in three of the six builds, and the operator can change it.

Rapid7's table lists 14 numbered command codes and introduces them as "the most operationally significant," not as the full set. Among them:

• 21 and 22: download a file from the host and upload one to it, both with resume support.
• 912: open an interactive shell session, up to ten at once.
• 1010: load or unload a shared object module that extends the implant.
• 1618: open a proxy or port forward channel through the appliance.

Any code the implant does not recognize makes it close the socket and terminate, which Rapid7 says raises the cost of probing a live implant.

How Do BPFDoor and Rekoobe Impersonate SpamSniper?

The South Korean samples take SpamSniper's PID file and the process names of its components as their disguise. The Hacker News attributes the product to Jiran Group, which advertises it as "Korea's leading email security solution."

BPFDoor is a passive backdoor. It opens no port and waits for a trigger, as we explained in our earlier piece on BPFDoor inside telecom networks. The new variants use /var/run/spamsniper.pid as their mutex and pick a process name from a list of ten that includes /usr/sbin/chronyd. Rapid7 also describes how BPFDoor's controller now wraps the trigger in an HTTPS POST and relies on SSL offloading at edge proxies, so that it "may evade conventional deep packet inspection."

The Rekoobe based sample is the one tailored to a mail appliance. Its 26 instruction BPF filter matches TCP, UDP and SCTP over IPv4, plus UDP over IPv6, but only when the source and destination ports both equal 25. Rapid7's reasoning: a firewall in front of a SpamSniper box will commonly allow relay traffic from port 25 to port 25, so a magic packet shaped that way would reach the raw socket "before any stateful inspection."

Its process names come from an encrypted table that includes /sniper/snipe/bin/snipe-smtpd and /sniper/bin/crond -n. The reverse shell calls itself /sniper/autorun/rblsmtpd --start -n 9 and connects back to port 25 on the attacker's side.

Who Is Behind AVERAT, and What Is Still Unknown?

Nobody has been named: Rapid7 attributes neither campaign to a threat group in this report. It writes of "threat-actor(s)," treats Taiwan and South Korea as two campaigns, and ends with a caution: "Specific attribution should remain an ongoing assessment as new samples and infrastructure emerge."

The Red Menshen name often attached to BPFDoor comes from elsewhere. Rapid7's March 26, 2026 report tied BPFDoor implants in telecom networks to that China nexus actor, and The Hacker News repeats the link. Neither source extends it to AVERAT.

What Rapid7 does describe is the relay layer. Three AVERAT builds call attacker registered domains and three call hardcoded IP addresses. Those addresses sit in Chunghwa Telecom's HiNet space (AS3462) and belong to other victims: a fuel retailer's Synology NAS, an obsolete NetKlass network appliance and a Dahua video recorder. All three expose PPTP on port 1723 with a byte identical banner, which Rapid7 assesses the operators installed.

Rapid7 says that device profile matches what CISA and partner agencies described on April 23, 2026 in advisory AA26-113A on China nexus covert networks of compromised devices, which Rapid7 equates with operational relay box (ORB) networks. It stops short of the next step and calls the infrastructure "consistent with the broader ORB device-class pattern rather than confirmed membership in a known network."

The report also leaves open how the attackers reached the appliances, how many organizations were hit and whether any mail was read. We found no public statement from ShareTech or Jiran in the coverage we reviewed.

Why Email Users Should Care: The Gateway Sits in Front of Your Mail

Nothing in Rapid7's report says a single message was stolen. The position is what matters. Both campaigns, Rapid7 writes, target "mail-security appliances that sit inline in front of the mail server, giving an implant positioned there visibility into an organization's inbound and outbound traffic." When you email a company that runs such a gateway, your message crosses it before any person reads it.

The pattern has a precedent. In 2023, Mandiant tied a suspected China nexus actor it tracks as UNC4841 to the exploitation of CVE-2023-2868 in Barracuda Email Security Gateway appliances, starting as early as October 10, 2022. Its primary backdoor, SEASPY, was "a passive backdoor that establishes itself as a PCAP filter on ports TCP/25 (SMTP) and TCP/587 and is activated by a 'magic packet'." Early builds were installed under the file name BarracudaMailService.

SEASPY filtered the SMTP port for a wake up packet and wore the Barracuda product's name. The Rekoobe build Rapid7 describes filters port 25 for a wake up packet and wears SpamSniper's. Three years on, the vendor and the country changed and the design did not. Rapid7 draws no line between the operators. Neither do we.

Mail gateways were already having a bad few weeks. Cisco disclosed an exploited zero day in Secure Email Gateway on September 14, and Fortinet followed with an exploited FortiMail flaw on October 1. No source connects those bugs to this malware. They show how intruders get onto such appliances. Rapid7 shows what a tailored implant looks like once someone is in.

How Can Defenders Hunt for AVERAT and BPFDoor?

Defenders should hunt for behavior, because Rapid7 warns that "File-based detection on the appliance is unlikely to succeed" when no payload stays in /sbin. Rapid7 gives checks, not commands; the flags below come from the Linux manual pages.

1. Processes whose executable is gone. Look for /proc/<pid>/exe links that point at an unlinked path. The proc manual page confirms the link target carries (deleted) once the file is removed.
2. Raw packet sockets and classic BPF filters on Linux systems that have no reason to capture packets. The ss manual page documents -0 to display PACKET sockets, -b to show classic BPF filters (administrators only) and -p to show the owning process.
3. Port 25 from the wrong process. Review outbound TCP port 25 connections from processes that are not mail services, especially ones that rename themselves to a common daemon. On the network, Rapid7 flags outbound SMTP from an appliance to mail hostnames that resolve to consumer grade or embedded devices.
4. Staging artifacts. The directory /HDD/ms6x2xTo64/, a file named updIptable.php that begins with #!/bin/sh, a marker file execProcEnd and hidden state files such as /var/lib/.db. In process logs, watch for sh -c on a .php path followed by copies into /sbin that are removed within roughly ten seconds.
5. Network indicators, all on TCP/25. Domains: mx.zxopfds[.]com, spam.suwaccqi[.]com, mx1.wwstifsteel[.]com. Addresses: 59.125.211[.]65, 122.116.138[.]33, 1.34.200[.]85.

If one of these checks hits, Rapid7 advises preserving the staged binaries and collecting process arguments, open file descriptors, socket metadata and historical DNS records. It also notes that in this chain "everything happens in memory while the persistence needed to re-establish access is on disk."