Could a drug intended to prevent painful rashes also protect our brains as we get older? The signs are promising – but not conclusive. Yet that’s enough to be driving a boom in shingles jabs
When Jenny, a 50-year-old marketing and branding professional from Cambridge, went for her shingles vaccine last year, an entirely different disease was on her mind. Having witnessed three of her four grandparents succumb to dementia, with all the distress that brought, she wants to avoid the same fate. She hopes the shingles vaccine might help.
Jenny is far from alone. Britain’s high street chemists have reported a rise in demand for the shingles vaccine, at least some of which is driven by people more worried about dementia than shingles. And while the vaccine is free for some on the NHS, most under-65s pay around £450 for the full two doses.
Since the days of Dr. Alzheimer himself, there has been a dream that severe senility might have an explanation — and a cure. The search for both has never been more urgent.
The sleep disorder has been the butt of jokes and a comedic plot point, but the reality of living with narcolepsy is anything but funny. Things could be about to change for people with the condition though, after the US Food and Drug Administration (FDA) approved the first ever drug to treat narcolepsy itself, rather than just its symptoms. Madeleine Finlay tells Ian Sample how the scientific breakthrough came about, and Julie Flygare, who has narcolepsy and founded the non-profit Project Sleep, explains what it is like to live with the condition and how the drug could be gamechanger
Some change in our lifestyles and environments over a generation has caused this increased risk. What, exactly, is a mystery
Prof Devi Sridhar is chair of global public health at the University of Edinburgh
In the field of global health, we often talk about each generation living longer and healthier lives than their parents. We’ve seen this in the gains in life expectancy, the sharp decrease in child mortality and in the near elimination of many vaccine-preventable diseases. But since the turn of the century this progress has stalled, and in some cases several health metrics have gone backwards.
Take cancer, which was long thought to be a disease linked to old age. While most cancers do indeed still occur in elderly people, a new report highlights that a number of cancers are increasing in people who are under 50, often referred to as “early onset cancer”. The report, undertaken by the World Cancer Research Fund, looked at data from 12 different cancer types in England, the US and the Netherlands over the past 20 years. What they found isn’t pretty.
Prof Devi Sridhar is chair of global public health at the University of Edinburgh
We have a deep reservoir of assets, but struggle to turn small companies into global success stories. Innovation needs to be at the heart of government policy
Gordon Brown was UK prime minister from 2007 to 2010
The coming 10 years are almost certain to be the decade that sees the greatest scientific breakthroughs in a century. The question is whether advances now under way in AI, quantum computing and biology can address cancer, find ways to treat or prevent dementia, and overcome the growing resistance to antibiotics. Can we find sustainable ways to address our energy needs and protect the environment at the same time? Can AI transform the way we deliver education, health and social care to the benefit of millions, as well as advance modern manufacturing strength? And what role can Britain’s inventors, investors and industrialists play in developing these transformative technologies?
While the US and China are the world’s obvious innovation powerhouses, the UK also has enormous assets, as the Innovation Nation Conference in Manchester addressed by the prime minister, Andy Burnham, will hear today. We are home to four of the world’s top 10 universities and 16 of the top 100, five of which are in Europe’s top 10 for spin-outs, startups based on intellectual property produced through a university’s research. With less than 1% of the world’s population, the UK produces 6% of the world’s research papers, nearly 9% of citations and 12% of the most highly cited research.
Gordon Brown was UK prime minister from 2007 to 2010
Species with leaves large enough to be seen from space is already critically endangered – and plans are afoot to protect it
A chance social media encounter has led to the race-against-time discovery of a new species of giant waterlily that has until now been hidden in the depths of Colombia’s jungle.
But the plant, which is so huge it is visible from space, is already considered critically endangered.
After scheduling a visit with the hospital’s urgent care facility, the patients discussed their ailments with a Google chatbot before meeting with their doctors.
Researchers found five events, including Russia’s invasion of Ukraine, caused serious damage to mental wellbeing across UK
Brexit, Liz Truss’s mini-budget and other “shocks” over the last 10 years have led to a serious and lasting deterioration in the UK population’s mental health, research has found.
Russia’s invasion of Ukraine and the first and second Covid lockdowns also triggered big rises in psychological distress, as measured by the number of people with depression and anxiety.
With cancer cases rising fastest in poorer countries, Zainab Shinkafi-Bagudu, president-elect of the Union for International Cancer Control, says Africa needs investment in research, diagnosis and prevention
When Dr Zainab Shinkafi-Bagudu last saw Gloria in Abuja, the young breast cancer patient was so ill that she was in hospital. The cancer had spread to her bones and lungs, and she was struggling with complications from the disease.
Then, at a global conference oncancer thousands of miles away in Hong Kong last month, Bagudu saw her again. Gloria was walking with a stick because of the cancer in her hips, but she was attending sessions, speaking about her experience and advocating for other patients.
Vaccine safety experts say more research into the side effects would be welcome yet question whether the health secretary’s effort will be grounded in science.
More than half of US students surveyed said the problem damaged their ability to do academic work, study finds
Procrastination is the biggest problem that can harm students’ academic performance at university, according to a study of more than 65,000 young people who placed it above issues such as ADHD, anxiety or financial worries.
The study found that nearly half of the students surveyed named procrastination as the thing damaging their ability to do academic work, more than twice the number who named depression, while the same proportion said procrastination caused them significant distress above any other problems including family pressures or bullying.
Operation on 19-year-old who had no sperm after chemotherapy offers hope of preserving children’s fertility after cancer treatment
Surgeons have performed the first testicular tissue transplant on a teenager in the UK, offering hope that boys left infertile by chemotherapy could one day have biological children.
The 19-year-old had his tissue removed and frozen three years ago before undergoing treatment for a serious blood disorder. He said he was “incredibly grateful” to the medical team behind the pioneering procedure, which represents a potential breakthrough for male fertility preservation.
In other plague matters, Russia Says It Found No 'Emergency' in Plague Lab: "Ms. Shipilova's [previously explained and now] unexplained death prompted the Russian authorities to quarantine part of the hospital where she was taken, the institute's staff and other people whom she had come into contact with in her final days." News comes on the heels of a report of a second death at the same hospital.
Drawing blood at an H.I.V. clinic in South Africa last year. The research networks’ large footprint has enabled them to develop tools to prevent and treat H.I.V., including in marginalized or rare populations.
This year’s Nobel prizes in chemistry, physics and physiology or medicine have celebrated work that has been used to develop countless drugs and transform modern medicine, allowed physicists to observe one of the most mysterious particles, and provided a tool that could act as an on/off switch for brain cells. To find out more, Madeleine Finlay talks to our science editor, Ian Sample, and correspondents Nicola Davis and Linda Geddes
New information around the death of a lab worker, including a statement that she had been vaccinated against the plague, came as U.S. officials demanded more data.
The entrance to the grounds of the anti-plague institute in Irkutsk, Russia, on Wednesday. An employee of the institute died of a mysterious pneumonia.
After a previous solution angered mathematicians, the company characterized the new release as being more responsive to concerns about A.I. disrupting research.
For 10 of the findings, OpenAI provided summaries of how the A.I. model came up with its solution. The average result took about three hours of computing, the company said.
From blood pressure to ageing, research suggests the first 1,000 days of sugar exposure could leave a decades-long mark on health
They were born into a Britain still recovering from the hardships of war. Though the air-raid sirens had fallen silent, many everyday foods remained rationed, including sugar. Adults were restricted to about 3 tablespoons (40g) a day to stretch between cups of tea, baking and desserts; children were limited to less than a tablespoon. Babies and very young children were expected to have little or no added sugar.
Then, in 1953, the brakes came off. Separate restrictions on sweets and chocolate were lifted in February, followed by sugar in September. By the second half of 1954, average sugar consumption had almost doubled.
China’s booming artificial intelligence sector has given local researchers good reason to remain in the country, but it has yet to lure overseas scientists despite a government push.
Chinese A.I. companies like Deepseek and Moonshot have made a name for themselves internationally. But China still struggles to recruit foreign researchers.
China’s booming artificial intelligence sector has given local researchers good reason to remain in the country, but it has yet to lure overseas scientists despite a government push.
Chinese A.I. companies like Deepseek and Moonshot have made a name for themselves internationally. But China still struggles to recruit foreign researchers.
Experts looking at UK, US and Dutch data found ‘significant increases’ in early onset cases of seven cancers, prompting warnings about lifestyle choices
Cases of seven types of cancer have risen sharply among younger people in England, major new research has found, prompting warnings that lifestyle choices are costing thousands of lives each year.
The number of people under 50 diagnosed with prostate cancer in England has quadrupled since 2001, while early onset bowel, kidney and uterine cancer diagnoses more than doubled.
As bipartisan backlash against Flock grows, some cities are asking anti-surveillance advocates and media outlets to pay eye-popping fees—including charging tens of thousands or even millions—to get information about how police departments are using and potentially abusing AI-enabled camera systems that track every vehicle that passes them.
On Monday, the Texas Tribune reported that city officials in a Fort Worth suburb, North Richland Hills, asked one group to pay $2.3 million before it would fulfill a public records request for Flock data. To reach that high fee, officials claimed that searching “about a terabyte worth of communications about errors, misuse, and effectiveness of the Flock system” would take approximately 14 years of labor at a rate of $15 per hour.
Phil Mynona, who filed the request using a pseudonym on behalf of his group, the Texas Privacy Coalition, told the Tribune that the fee seemed “ludicrous” and designed to stifle his public records searches.
Small particulates sent up by wildfires are a well-documented health hazard. But recent research finds that ground-level ozone is now on the rise, too.
The move, affecting about one-fifth of the National Science Foundation’s primary research budget, is the latest sign of how the White House is asserting more control over grants.
Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. Additionally, we provide source code details of the Rapid7 BPFDoor controller introduced in our April 2026 blog, Stealthy BPFDoor Variants are a Needle That Looks Like Hay.
The chain uses two binaries. A dropper writes a shell script to the appliance's storage mount and executes it. The script stages both payloads into /sbin under the names ntpdate and udevds, launches them, and deletes each file ten seconds later while the processes continue running. One of those payloads is the dropper itself, re-executing as a resident watchdog, leaving both processes running without an on-disk image.
The dropper derives its encryption key from the string ShareTech and lives in the appliance's own add-on package directory. The BPFDoor variants seen against South Korean systems impersonate the PID file of SpamSniper, a Korean anti-spam product, and rotate through ten Linux daemon names. Across the samples, each component adopts names and conventions designed to look unremarkable in the environment it targets.
The common thread is regionalized disguise: each sample is aware of the vendor’s software running on the targeted systems and implements process spoofing accordingly. Passive BPF implants avoid conventional port scans; while outbound beacons hide inside ordinary DNS, TCP, and traffic, the threat-actor(s) are leveraging SMTP to stay under the radar. Telecommunications and network-edge operators are most affected, including embedded devices such as CCTV and DVR systems that can sit close to the network core. Readers will learn how each component works, what binds the six AVERAT builds to one another, and which behaviors and indicators to hunt for.
Technical analysis
Rapid7 BPFDoor controller
Figure 1: Overview of BPFDoor HTTP-tunneled trigger flow through edge proxy
⠀
Following our introduction of the Rapid7 BPFDoor controller, published in March, this section examines new features from the reconstructed source code.
Earlier BPFDoor variants relied on raw "magic bytes" (like 0x7255 or 0x5293) sitting in the TCP or UDP headers. Once security vendors wrote static network signatures (Suricata/Snort) to detect these Layer 4 anomalies, the operators began targeting the edge proxies. By wrapping the magic packet in standard HTTPS POST requests and relying on SSL offloading common in telecom environments, the trigger can be delivered to the BPFDoor-infected node in a way that may evade conventional deep packet inspection.
Because proxies alter HTTP headers (adding X-Forwarded-For and changing User-Agent lengths), the malware can no longer rely on static byte offsets to find its payload. To solve this, the new controller sends fake, benign-looking web requests (e.g., POST /admin/login.aspx?id=99990) that are mathematically padded. This guarantees that the string "9999" lands at exactly offset 26 of the TCP payload consistently.
The backdoor uses this "9999" as a reference point, dynamically scans for the \r\n\r\n terminator, and extracts the hex-encoded command payload from the HTTP body.
The dogetlogin function contains the hardcoded paths blending in with legitimate requests:
Figure 2: Hardcoded web login paths used by the dogetlogin function
⠀
When running, the controller spoofs the identity of /usr/sbin/abrtd via set_proc_name and PR_SET_NAME. The #ifndef SOLARIS compiles safely across different operating systems, applying the abrtd disguise only where the Linux-specific prctl function is supported.
Figure 3: Process name spoofing logic applying the abrtd disguise on non-Solaris systems
⠀
The table below lists the Rapid7 controller flags, with new features identified relative to the TrendAI analysis marked accordingly.
Switch
Variable/Action
Description
-h
destip
Specifies the target host (the infected machine's IP address) to control.
-d
dport
Sets the destination port on the infected host to send the trigger packet to.
-l
lhost
Sets the remote IP address that the infected machine will connect back to (Reverse Shell).
-s
lport
Sets the destination port to listen for incoming connections on the attacker's machine.
-m
self = 1
Sets the attacker's local IP address as the remote host, automatically setting up the local listener (overwrites -l).
-b
bport
Instructs the controller to bind to a specified TCP port locally (Bind Shell mode).
-n
nopass = 1
Sends the packet without prompting for a password (sends an empty/hashed password). Often used just to check if the backdoor is alive.
-i
raw = 2
ICMP mode. Embeds the magic packet into an ICMP Echo Request.
-u
raw = 3
UDP mode. Sends the magic packet via a UDP datagram.
-w
raw = 1
TCP mode. Sends the magic packet via a raw TCP SYN packet.
-f
magic_flag
Allows the operator to manually define a custom magic byte sequence (integer value).
-o
magic_flag = 0x5571
Quick-sets the magic bytes/flag to 0x5571.
-H
hdestip
[NEW] Specifies a secondary "hidden" IP address to embed inside the newly added hip field used to relay the magic packet.
-g
gethost
[NEW] Activates the HTTPS POST tunneling mode (dogetlogin).
-D
dir
[NEW] Customizes the URI directory path to blend into specific web server logs when using the -g (HTTPS POST) mode.
-v
debug = 1
[NEW] Enables verbose/debug mode, which is particularly useful for printing out the crafted HTTP requests and responses.
-t
tmout
[NEW] Sets a custom timeout value.
-c
break;
[DEPRECATED] Parses the flag but takes no actions
Table 1: Rapid7 BPFDoor Controller Flags and Descriptions
A new BPFDoor variant tied to the South Korean cluster
The BPFDoor variants create a raw PF_PACKET socket, attaching a classic BPF filter matching Rapid7 Variant F and using magic bytes 0x6693 (UDP), 0x4274 (TCP) and 0x7820 (ICMP). On a match, the implant extracts the source address and connects back to the sender if the password is gZbpx0, opens a bind shell if the password is sT21xf, and otherwise defaults to a UDP knock.
Strings are hidden with a rotating substitution alphabet. Decoding reveals a direct product-spoofing artifact and a set of service-name disguises. The SpamSniper /var/run/spamsniper.pid mutex, together with the sample provenance, ties this build to the South Korean cluster.
SpamSniper is antispam software used mainly in South Korea, so this masquerade is consistent with targeting a Korean mail or telecom environment. The variants a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3 and 7e667ba5f9df912e02275d3cfe3809d16f822fe776f4035c84b118ebd925b1b5 share the same filter, packet parser, callback, and command paths.
The data plane variant
The BPFDoor sample (a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a) attaches a SOCK_RAW 16-BPF instructions parsing IP/TCP offsets and gates on a 14-byte payload (2B 76 C0 63 83 E9 5F E1 EE 69 3F 32 CD 94, unique per sample).
Figure 4: BPF filtering for abc00922 TCP magic bytes
⠀
It spoofs its process name to ora_ppmond, mimicking the naming convention of Oracle-backed telecom subscriber and provisioning platforms (HSS, OSS/BSS), a disguise that only reads as legitimate on hosts actually running that class of infrastructure. Once triggered, it opens a stock Tiny Shell session and dispatches single-byte 'S'/'U'/'D' commands — interactive shell, upload, download — the same switch-case and iptables NAT-redirect staging/teardown logic found byte-for-byte in a second sample 4435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9 (the latter spoofing /sniper/snipe/bin/dtnpd and /sniper/bin/ofgmd). These samples show BPFDoor operating as a modular framework that adapts to the telecom layer it targets, integrating Tiny Shell and Rekoobe logic to support exfiltration.
Figure 5: Tinyshell logic integrated into BPFDoor
⠀
BPF Rekoobe
The sample 652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f is a Rekoobe-based backdoor. It attaches a 26 BPF instruction filter, sniffing for TCP/UDP/SCTP IPv4 and UDP IPv6 traffic with source and destination ports equal 25. Strings are protected with a repeating-key XOR routine (uvTIgh47,@#R), which decodes internal markers and command tokens. The magic packet is authenticated against a 32-byte sequence: 5C A3 1E F9 72 84 DB 40 26 9F C8 35 E1 7D 0A B2 4D 68 93 0F E7 5A B4 21 8C D6 39 F2 47 1B 60 CE. C2 interactions begin by sending the following 12-byte handshake: 50 01 13 3F 08 5C 73 7B 1A 72 53 78 (decrypting to "%wGvo4GL62p*" using the XOR key above).
Process names are drawn from an encrypted table and set through argv rewriting (Table 2).
On a SpamSniper appliance, SMTP server-to-server relay traffic is the primary legitimate traffic type the appliance is designed to handle. A firewall in front of the appliance will commonly allow rules such as:
A magic packet withsrc=25, dst=25 would match the first rule and reach the raw socket before any stateful inspection. The implant authors understood exactly what traffic profile would be invisible on this specific class of host.
The command interface relies on the same cryptography (HMAC-SHA1, AES-CBC) and opcodes as the standard Tinyshell/Rekoobe.
By setting variables like VIMINIT="set viminfo=", HISTFILE=/dev/null, HISTSIZE=0, andHISTFILESIZE=0, the malware ensures that the attacker's commands are not logged to bash history nor to vim logs. The reverse shell spoofs "/sniper/autorun/rblsmtpd --start -n 9" and connects on the attacker's port 25. Rblsmtpd is a standard daemon used by mail servers (like qmail) to block mail from IPs listed in Real-time Blackhole Lists (RBLs).
A dropper likely built for ShareTech appliances
The dropper (update:2bedc26d4b29b435c21962beed7db21188a0219a0d28334bba8b4fb1656d7b15) is an x86-64 ELF with a minimal import table — fopen, fwrite, fputs, fclose, chmod, system, strlen, sleep, access, memcpy, exit — and no networking. It is a local installer, run after access is already established.
It carries four AES-128-ECB blobs keyed on the first sixteen bytes of SHA1("ShareTech"), or 6C CA D5 17 0E 3D B8 17 B3 DF 52 E0 D9 71 B1 48. The operators seeded their own key derivation with the target vendor's name.
Figure 6: AES key derivation seeding routine from SHA1("ShareTech")
Execution is gated on one precondition: the install branch fires only when /tmp/flag already exists on the filesystem and the .php script does not. When the gate passes, the dropper writes the script to the appliance's bulk-storage mount, chmods it 0777, hands it to system(), and exits. Because system() runs sh -c against a file carrying a real shebang, /HDD must be both writable and exec-capable. A noexec mount returns EACCES, for which the shell offers no interpreter fallback.
The script then copies two malicious binaries from /addpkg into /sbin as ntpdate and udevds, runs each, and unlinks them ten seconds later. Both keep running with no on-disk image: /proc/<pid>/exe resolves to (deleted), so there is nothing to hash, quarantine or submit, and a responder grepping /sbin finds nothing at all.
The elegant part is that /sbin/ntpdate is the dropper re-executing itself; the second instance finds the .php already present, fails the gate, and drops into a two-second watchdog that recreates execProcEnd and re-writes the script whenever either disappears. That also explains the absence of any persistence code: /addpkg/sbin/ is the appliance's own add-on package directory, so the firmware's package startup very likely relaunches it at boot.
AVERAT: A modular implant reaching into ORB
The dropper copies AVERAT into /sbin/udevds, marks it executable, launches it, sleeps ten seconds, and removes it.
Command and control
The implant connects outbound to port 25 and speaks SMTP: it issues EHLO, requests STARTTLS, and only then begins its own encrypted session. On a mail security gateway, outbound SMTP to arbitrary mail exchangers is the device's core function, so the traffic is indistinguishable from legitimate work in flow records.
The TLS layer is hand-built rather than linked from a standard cryptographic library. A fixed ClientHello template is compiled into the binary, including a 40-entry cipher suite list and a fixed extension ordering. Peer authentication is deferred entirely to the application layer via a shared-secret handshake carrying the magic value 1571 (0x0623).
Check-ins occur every 600 to 699 seconds. Each reports hostname, current user, OS version, network interfaces, and logged-in users. The interval is stored in a hidden file at /var/lib/.db and can be changed by the operator, persisting across restarts.
Figure 7: AVERAT beacon configuration details and persistent state file path structure
⠀
AVERAT takes its name from its only disk artifact: var, which reads as AVE when XOR-encoded (Figure 7).
Configuration
All operational values are held in a 276-byte encrypted blob. The key is derived from the blob's own first 16 bytes, folded with a further byte and a reverse XOR cascade; that key seeds RC4's key-scheduling algorithm, and the resulting S-box is used directly as a keystream. Each field starts at its own keystream offset, and the parity of that offset selects whether bytes are bitwise-inverted or nibble-rotated before the XOR.
Decrypted, the blob yields three 16-byte keys (transport, authentication, and a secondary handshake secret), the host table, the port table, a three-byte build tag, the timing state, and the .db path.
Figure 8: Key derivation and keystream offset mapping
⠀
The schema provides three host and port pairs; this build populates one.
Figure 9: Decrypted AVERAT host and port table configuration slots
⠀
Rapid7 developed an extractor for the AVERAT family. Figure 10 shows the results for the samples identified at the time of writing.
Figure 10: AVERAT extractor results and sample hashes identified at the time of writing
⠀
The MAC key and aux key are byte-identical in all six, while only one stream key is shared between a pair (Figure 10).
Command set
Command codes are uint16 values grouped into bands by subsystem. The most operationally significant are below.
Code
Capability
20
Enumerate directory contents
21
Download a file from the host, with resume support
22
Upload a file to the host in chunks, appending on resume
25
Recursively delete a file or directory tree
30
Recursively walk a directory tree, resolving file ownership
629
Enumerate running processes with command lines
632
Terminate a process (SIGTERM)
842
Overwrite the C2 host and port tables at runtime
912
Open an interactive shell session — up to ten concurrently
914
Write a command into an open shell session
916
Reboot the appliance, flushing buffers to disk beforehand
1010
Load or unload a shared-object module, extending the implant
1576
Set the callback interval and persist it to .db
1618
Open a proxy or port-forward channel through the appliance
unknown
Close the socket and terminate the process immediately
Table 4: AVERAT Command Codes and Capabilities
Infrastructure
The three IP addresses recovered from the configs represent compromised CPE belonging to third-party victims rather than intentional operator assets. Scan data shows all three sitting in Chunghwa Telecom's HiNet address space (AS3462), in three separate Taiwanese cities — Tainan, Banqiao and Taoyuan — each representing a distinct class of neglected, internet-facing consumer or SMB appliance.
59.125.211.65 is a Synology NAS belonging to a Taiwanese fuel-retail business, still serving a Laravel-based "cloud management system" on 81/82 behind a Let's Encrypt certificate that expired in October 2021, alongside an exposed MariaDB 5.5.62 instance that reached end of life in 2020. 122.116.138.33 is an embedded Taiwanese ADSL/FTTH SMB network appliance — gSOAP 2.8 on 8000 with a recording-management interface, HTTP Basic realms named SMB on 8081, 8082 and 10443, and a self-signed NetKlass Technology certificate valid from 2004 to 2014, MD5-signed with a 1024-bit key. 1.34.200.85 is a Dahua DH-XVR5116HS-I3 recorder. These are victim hosts repurposed as operational relays, selected on consistent criteria: reachable, unpatched, unmonitored, and unlikely to be audited.
The detail that binds them is PPTP on 1723, present on all three, returning a byte-identical banner (Firmware: 1, Hostname: local, Vendor: linux, fingerprint 261189147). A Dahua XVR ships no PPTP server. Synology's DSM offers one only as an optional package, disabled by default and deprecated in current releases. We assess this as operator-installed, which makes each node dual-purpose: an outbound relay terminating SMTP-disguised implant traffic, and an inbound routed VPN foothold into the host's own LAN. Combined with the RAT's own proxy commands, the campaign has relay capability at both ends of the connection.
The campaign is running two distinct C2 addressing strategies:
Strategy
Samples
Trade-off
Attacker-registered domain
bf8135f4, 2fe2dd40, a65048eb
Survives IP churn, re-pointable via DNS — leaves a seizable, sinkholable, monitorable name
Hardcoded consumer-broadband IP
4925bcca, a4379e11, 925c0418
No DNS artifact at all, brittle against address rotation
Table 5: C2 Addressing Strategies Comparison
The relay layer is composed of consumer and small-business broadband CPE: a fuel retailer's NAS, an obsolete NetKlass appliance, and a CCTV recorder, each sitting on a domestic-grade line.
AVERAT's command-and-control infrastructure matches the device-class profile that CISA, NCSC-UK, and partner agencies described in their April 2026 joint advisory (AA26-113A) as the standard building blocks of China-nexus covert/ORB networks: end-of-life NAS, edge appliances, and DVRs chosen because their vulnerabilities will never be patched. We found no infrastructure or indicator overlap with any specific named ORB network (LapDogs/UAT-7810, SPACEHOP, or FLORAHOX), whose documented targeting instead centers on SOHO routers; AVERAT's infrastructure is consistent with the broader ORB device-class pattern rather than confirmed membership in a known network.
Operator tradecraft
Three design decisions indicate operational maturity.
The dispatcher terminates the process on any unrecognized command code. This is inexpensive to implement and raises the cost of interactive probing or automated scanning against a live implant.
Support for ten concurrent shell sessions is consistent with provisioning for parallel operator access rather than a single interactive session..
The reboot handler calls sync() before forcing a restart through the kernel rather than through init. Flushing filesystem buffers before destroying volatile state is the behavior of an operator who knows precisely which artifacts persist across a restart and which do not — and in this chain everything happens in memory while the persistence needed to re-establish access is on disk.
Detectionguidance
File-based detection on the appliance is unlikely to succeed, because no payload persists in /sbin. We recommend prioritizing the following.
On the host, hunt for processes whose executable has been unlinked, which on Linux presents as a (deleted) suffix on the /proc/<pid>/exe target. To catch fileless and unlinked process execution, monitor process descriptors for instances where /proc/<pid>/exe points to an unlinked path, and inspect memory maps for executable pages lacking backing file paths on disk.
Additionally, alert on the presence of .db state files and dropper artifacts: the directory /HDD/ms6x2xTo64/, a shell script carrying a .php extension whose first bytes are #!/bin/sh, and a marker file execProcEnd containing the literal string end. A process-tree sequence of sh -c on a .php path, followed by cp and chmod into /sbin and an rm -rf of the same path within roughly ten seconds, provides high-fidelity detection of the staging sequence.
On the network, outbound SMTP from an appliance to mail-role hostnames that resolve to consumer-grade or embedded devices warrants investigation on its own.
Mitigation
Investigate unexpected raw packet sockets and classic BPF filters on Linux systems that do not require packet capture. Review outbound TCP port-25 callbacks from processes that are not mail services, particularly when the process renames itself to a common daemon or creates hidden PID and socket markers. Preserve short-lived staged binaries and collect process arguments, open file descriptors, socket metadata, and historical DNS records. Restrict management access to routers, DVRs, and other edge appliances, and monitor NFS or SMB mounts that could let an adjacent host write executables onto an embedded device.
YARA rules and more IoCs are available in Rapid7’s Intelligence Hub along with ongoing intelligence on the latest campaigns.
What defenders should take away from these campaigns
The components form a modular access ecosystem. The dropper executes AVERAT, which beacons to changeable infrastructure, while BPFDoor and Rekoobe samples wait for a magic packet before opening interactive access.
Across both campaigns, the network edge is a consistent focus. Each targets mail-security appliances that sit inline in front of the mail server, giving an implant positioned there visibility into an organization’s inbound and outbound traffic. Both also use port 25 to blend into expected SMTP activity, although the mechanism differs between the campaigns. In either case, command-and-control traffic can hide within a protocol that is normal for the device and may therefore attract less scrutiny.
This fits the broader BPFDoor pattern, where compromised IoT and SMB devices, including NAS units and DVRs, can act as operational relays that obscure the true source of magic-packet traffic before it reaches the passive backdoor. Newer samples also show how the malware continues to adapt to the environments it targets, including a second userland-level magic-packet check layered on top of the kernel BPF gate.
Rapid7 Variant G provides another example of that adaptation. It uses three BPF filters to preserve operational resilience on high-traffic edge nodes, with the filters left unoptimized because the libpcap version running on its end-of-life targets does not support filter optimization.
For defenders, the most useful detection opportunities remain raw packet sockets, BPF filters, port-25 callbacks from unexpected processes, process masquerading, and appliance-specific staging paths. Specific attribution should remain an ongoing assessment as new samples and infrastructure emerge.
In a setback for publishers worried about the effects of AI search, a US federal judge has dismissed lawsuits filed by Chegg and Penske Media against Google. The companies accused Google of antitrust violations in products like AI overviews, which have led to decreasing traffic at numerous sites. However, US District Judge Amit Mehta has ruled that Google's conduct is not illegal under antitrust law.
The lawsuits were filed in 2025, and Google requested a dismissal earlier this year. Chegg, an education and learning platform, claimed in its lawsuit that Google illegally scraped its educational content. This allowed Gemini models to essentially recreate that content and reduce the site's traffic. Penske, which owns publications like Rolling Stone and Variety, filed a similar case that alleged lost traffic. Specifically, the publisher claimed it was unfair that sites indexed for organic search would also have their content harvested for AI answers, with no way to opt out.
These arguments did not sway the judge, who noted that Google's implicit agreement with websites is not legally relevant. "Plaintiffs have pleaded only that they have an ‘expectation’ that Google will send them search traffic if they make their content available for free," wrote Mehta. "But an expectation is not an agreement. It is simply how a general search engine works."
Google's shift to AI-powered search has upended the way the world's largest search engine generates web traffic, rankling large and small publishers alike. In recent months, the company has experimented with paying publishers when their content appears in AI answers, but a new report claims the payouts in this pilot program are miniscule. That has publishers in the program, as well as those watching from the sidelines, feeling skeptical.
According to The Information, Google has admitted about 100 publishers to the AI contribution pilot. The pitch is that websites can get payments from Google when their content materially contributes to Gemini-powered search results like an AI Overview. Google has long resisted the idea of direct payments to publishers, arguing that websites get traffic in exchange for allowing Google bots to scrape their content for use in search and knowledge graph tools. In the age of AI, that relationship is breaking down, hence the AI pilot.
So far, publishers aren't getting much for their trouble. The Information heard from several small and mid-sized publishers in the program that Google's AI payments are minuscule, equaling roughly one-tenth of one percent of their advertising revenue. These payments have been so disappointing that several larger publishers have reportedly declined to participate in the program. These publishers hope that by refusing to join the pilot, they can force Google to offer a more generous deal.
Over 90 percent of Ukraine’s scientific discoveries have been attributed to Ukraine’s National Academy of Sciences, including advancements in astronomy and military technology.
Employees and security researchers said that they had cautioned the company on safely testing its A.I. models and strengthening its corporate infrastructure, but that OpenAI did not listen.
Over 90 percent of Ukraine’s scientific discoveries have been attributed to Ukraine’s National Academy of Sciences, including advancements in astronomy and military technology.
Evidence suggests that it really affects what psychiatrists like me call sustained engagement — an important difference in understanding how to think about the condition.
An expert at the University of Copenhagen said his team had been sharing its research with the company’s A.I. model, Claude, and that its new finding matched their work.
A protest outside the Centers for Disease Control and Prevention last year after employees were laid off. Beyond staff reductions, the agency also faces a leadership vacuum.
A scrappy science project led to a significant discovery: two new species of a rare organism that could elucidate a fundamental transition in the history of life on our planet.
Scientists observed a family of pygmy raccoons near a Cozumel beach club learning from one another how to craft balls from paper, an indication that the animals have a culture.
Login
