Rapid7 Unveils Disturbing Findings on State-Sponsored Cyber Espionage

On March 26, 2026, Rapid7 Inc. (NASDAQ: RPD), a leading player in AI-powered managed cybersecurity, released significant findings from its latest research investigation, “Sleeper Cells in the Telecom Backbone.” The report uncovers a sustained espionage campaign attributed to a China-linked threat actor known as Red Menshen, who has gained covert access to global telecommunications infrastructure.

Rapid7’s research indicates a troubling shift from opportunistic cyber intrusions to a more calculated, long-term strategy of embedding sleeper cells within telecommunications networks. These sleeper cells are designed to operate undetected, enabling continuous surveillance of subscriber activities, signaling systems, and sensitive communications. This level of access raises alarms, as it offers attackers the ability to conduct intelligence collection on a grand scale, potentially affecting government, commercial, and critical infrastructure operations.

Raj Samani, Rapid7’s chief scientist, emphasized the gravity of this issue: “If you have access to telecommunications infrastructure, you are not just inside one company; you are operating close to the communication layer of entire populations. This makes this type of access highly valuable and elevates detection to a national-level concern.”

One of the most alarming findings from the report is the identification of a Linux kernel-level backdoor, dubbed BPFdoor. This sophisticated malware operates without opening ports or engaging in typical beaconing activities, which makes it particularly challenging for standard endpoint and network monitoring tools to detect.

Additionally, the report highlights the weaponization of encrypted traffic, with a newly identified variant of malware that conceals command triggers within legitimate HTTPS traffic. This allows the threat actor to bypass modern security controls, activating dormant implants through SSL termination points, such as load balancers and proxies.

The investigation also reveals that Red Menshen has targeted specialized signaling protocols, including SCTP, which provides visibility into subscriber activities such as location tracking and identity-related data across 4G and 5G networks. Furthermore, the malware is capable of service masquerading—imitating legitimate infrastructure and management services—to blend seamlessly into routine operational activities.

Christiaan Beek, vice president of cyber intelligence at Rapid7, noted, “This is not traditional espionage; it is pre-positioning inside the infrastructure that nations depend on.” This persistent access model indicates a need for organizations to adopt preemptive detection strategies to identify unusual service masquerading and stealth activation mechanisms before they can be exploited for high-level intelligence collection.

To aid in this effort, Rapid7 has released a free, open-source scanning script designed to detect both known and emerging variants of BPFdoor. This tool is intended to help organizations proactively validate their exposure and initiate incident response investigations as required.

Rapid7’s findings will be further explored in a session titled “Sleeper Cells in the Telecom Backbone,” presented by Christiaan Beek at the RSAC 2026 Conference in San Francisco on March 26 at 12:20 p.m. PT. Additionally, Raj Samani and Beek will host an exclusive webinar on March 30 to discuss the implications of these findings on global telecommunications.

The findings from Rapid7’s investigation underscore a significant evolution in cyber threats, particularly within the realm of telecommunications. As state-sponsored actors like Red Menshen develop more sophisticated methods for embedding themselves within critical infrastructure, organizations must prioritize robust detection and response strategies to safeguard their networks and the broader communications ecosystem. Rapid7 remains committed to enhancing cybersecurity resilience and providing vital intelligence to help organizations navigate this complex threat landscape.