Rapid7 Wins 2026 Peter Szor Award for Telecom BPFDoor Research

Rapid7 Intelligence received the 2026 Péter Szőr Award for Outstanding Research this week at the Virus Bulletin conference in Seville. The honor recognizes the firm’s technical investigation into BPFDoor, a sophisticated implant designed to establish long-term strategic positioning within telecommunications backbone networks.

The award committee cited the research for pairing deep technical analysis with real-world defensive impact. According to the nomination, the work involved extensive collaboration with agencies and Computer Emergency Response Teams (CERTs) globally. The team provided tools, scripts, and detection capabilities to help defenders identify these passive backdoors and kernel-level capabilities that operate quietly within critical infrastructure.

Context Behind the Award

Virus Bulletin established the award to honor the life and work of Péter Szőr, a respected figure in malware analysis known for his rigorous and useful research. The Rapid7 researcher who accepted the award noted having learned from Szőr early in their career, specifically recalling their joint analysis of the Stuxnet malware. That investigation demonstrated how engineering, tradecraft, and espionage could combine to create physical-world consequences, marking a significant shift in the cybersecurity landscape.

The recipient emphasized that Szőr’s legacy was defined by curiosity and a desire to help others understand complex technical issues. Receiving an award bearing his name felt like a full-circle moment for the researcher, who valued Szőr’s approach to sharing knowledge rather than keeping insights private. The award represents a high level of recognition in the industry, honoring work that is both deep and practically useful for the security community.

Who Is Affected

Telecommunications networks carry communications, identities, and essential services for governments and businesses, making them high-value targets for adversaries. The BPFDoor research highlighted how attackers set up camp in these environments to maintain covert access without rushing their operations. This long-term strategic positioning allows threat actors to settle into critical infrastructure, creating sleeper cells that can remain undetected for extended periods.

The impact of such compromises extends beyond individual machines or single companies, potentially affecting the broader reliability of communications and data services. Rapid7 Intelligence stated that the research emerged after months of investigating these stealthy access methods, which differ from conventional malware drops. The implants rely on passive backdoors and kernel-level capabilities to maintain persistence, posing a significant risk to the integrity of the telecom backbone.

What should you do?

Rapid7 Intelligence continues to analyze new samples and track changes in operator tradecraft following the initial report. The team has identified previously undocumented BPFDoor variants, including httpShell and icmpShell, which are built to make detection more difficult. Further publications have expanded the scope to include additional Linux implants like AVERAT and techniques that hide within ordinary-looking traffic such as SMTP. This ongoing work underscores the need for continuous monitoring and information sharing among researchers, vendors, and government CERTs.

What to do and how to stay safe: Rapid7

• Monitor kernel-level processes in telecommunications and network-edge environments for unusual activity or unauthorized capabilities.
• Review traffic logs for anomalies in standard protocols like SMTP, HTTP, and ICMP that could indicate hidden command-and-control channels.
• Collaborate with industry CERTs and share intelligence on suspicious implants to improve collective detection capabilities.
• Verify the integrity of critical infrastructure components regularly, as sleeper cells may remain dormant for long periods before activation.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is BPFDoor?

BPFDoor is a stealthy implant that establishes passive backdoors and kernel-level capabilities within telecommunications networks to maintain long-term covert access.

Why did Rapid7 win the 2026 Peter Szor Award?

Rapid7 won the award for its rigorous research into BPFDoor, which combined deep technical investigation with practical tools and intelligence for global defenders.

What new variants have been identified?

Researchers have found new variants including httpShell and icmpShell, as well as additional Linux implants like AVERAT that hide in ordinary traffic.