Cyber Warfare Asia

A China-linked cyber threat group has been quietly operating inside telecom networks, prepositioned. Dormant presence meant to be used later. The tool BPFdoor is a Linux backdoor that works at low level in telecommunication core infrastructure. This improves stealth and covert activity. When listing processes or connections, those are not visible (like the 90s and 00s kernel rootkits, so let's call it 26-year-surprising). It can also hide its activation signal inside normal HTTPS network traffic (web browser-like), lets the network's own SSL decryption layer termination decrypt it, and then fires commands. This means that web application firewalls and proxies are effectively bypassed. BPFdoor has been found monitoring SCTP traffic. SCTP is the protocol that carries 4G and 5G signalling between core telecom network functions -- registration requests, subscriber identity, device location updates.

Intellexa Predator cyber tool (spyware hacking user devices) operates across multiple countries, recent targets identified in Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, and Tajikistan. Among the users are at least 25 countries including Germany, Austria, Switzerland, Qatar, Congo. Once a device is hacked and infected, Predator provides complete access to encrypted messaging apps like Signal and WhatsApp, email, photos, location data. It can remotely activate cameras and microphones. The system had at least 15 zero-day exploits in use since 2021. A very interesting revelation indicates Intellexa's operational access to client systems. Training videos show company staff remotely connecting to live government systems, observing real-time infection attempts, viewing logs of targets, and accessing backend interfaces normally reserved for government operators. The company uses an infection method called Aladdin that can silently infect phones through malicious digital advertisements without any user interaction, exploiting the global online advertising ecosystem. The system uses public IP addresses to target specific devices, instructing ad platforms to deliver exploit code disguised as normal advertisements on legitimate websites and apps. Intellexa has adapted its infrastructure to evade detection, hiding behind services like Cloudflare and establishing front companies in Dubai's free trade zones to handle logistics and facilitate the advertising-based infection operations. securitylab.amnesty.org/late… cloud.google.com/blog/topics… recordedfuture.com/research/… haaretz.com/israel-news/secu…