New AVERAT Linux implant hides command traffic inside SMTP on telecom edge devices
Rapid7 documented a new modular Linux implant called AVERAT alongside fresh BPFDoor variants, both abusing TCP port 25 to blend command-and-control traffic into ordinary mail flows.