Rapid7’s BPFDoor Kernel Backdoor Study Wins 2026 Péter Szőr Award

Rapid7 Intelligence researchers secured the 2026 Péter Szőr Award this week at the Virus Bulletin conference in Seville. The honor recognizes their discovery of BPFDoor, a sophisticated backdoor campaign that has established long-term, undetected presence within telecommunications networks around the world.

These implants are not typical malware dropped during an initial breach. According to Rapid7, they represent strategic positioning, allowing adversaries to remain passive and hidden for extended periods. The tools operate at the kernel level, granting covert access to the backbone systems that handle global communications, identities, and government services.

Context and background

The award, created by Virus Bulletin, honors the legacy of Péter Szőr and recognizes rigorous, useful technical security research. Rapid7’s work involved months of investigating stealthy access inside telecom environments. The research team collaborated extensively with agencies and Computer Emergency Response Teams (CERTs) worldwide to share detection tools and intelligence.

This collaborative approach helped defenders identify the threat across multiple regions. The study highlighted that the impact of such intrusions extends far beyond a single compromised machine, threatening the stability of the entire communications infrastructure that businesses and governments rely on daily.

Who is affected

Telecom providers and network-edge environments are the primary targets of this campaign. The implants settle quietly into critical infrastructure, meaning service providers using affected Linux systems are at risk. Because these networks carry everything from personal communications to enterprise operations, any compromise could potentially expose vast amounts of sensitive data or disrupt services.

The attackers have shown a willingness to wait, indicating that these backdoors may have been present for a long time before detection. This makes the threat particularly insidious for organizations that assume their networks are clean after a standard security scan.

Our take on the response

Rapid7 Intelligence continues to analyze new samples and track changes in operator tradecraft. Since the initial report, the team found previously undocumented variants of BPFDoor. They also identified new httpShell and icmpShell variants designed to make detection even more difficult for security teams monitoring network traffic.

The researchers emphasize that publishing the initial findings was just a checkpoint. They are actively working with the community to identify additional Linux implants and infrastructure targeting telecom sectors, including threats like AVERAT that hide in ordinary-looking traffic such as SMTP.

For customers and users

Organizations operating telecommunications infrastructure should immediately review their kernel-level configurations for any unauthorized modifications. Teams usually conduct regular audits of their network backbone to ensure no passive backdoors remain active. Users should check whether their service providers have addressed known vulnerabilities in their Linux environments. Be vigilant for follow-up scams that often emerge after major security disclosures, such as phishing emails claiming to offer fixes or updates for these specific backdoors.

Background: Backdoors

Use this checklist to verify your system integrity. Focus on disabling unused network services, verifying boot integrity, and monitoring for unexpected administrative access. These steps reduce the attack surface where attackers install hidden entry points. Regular audits ensure no unauthorized software remains active on your network.

Read the full guide: Backdoors Prevention Checklist for Securing Systems

What to do and how to stay safe: Rapid7

• Review kernel logs and system processes on Linux servers for unusual or undocumented activities.
• Monitor network traffic for anomalies in ICMP and HTTP protocols that could indicate httpShell or icmpShell usage.
• Coordinate with telecommunications providers to verify if their infrastructure has been scanned for BPFDoor variants.
• Remain cautious of unsolicited security alerts or patches that do not come from official vendor channels.

Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work

General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is BPFDoor?

BPFDoor is a backdoor implant that operates at the kernel level within telecommunications networks, allowing for long-term, covert access by adversaries.

Why did Rapid7 win the Péter Szőr Award?

Rapid7 received the award for its rigorous research into BPFDoor, which included deep technical investigation and real-world collaboration with global agencies to protect critical infrastructure.

Are there new variants of this threat?

Yes, Rapid7 has identified previously undocumented variants, including new httpShell and icmpShell versions designed to evade detection more effectively.