Malware
GTPDOOR
According to haxrob, GTPDOOR is the name of Linux based malware that is intended to be deployed on systems in telco networks adjacent to the GRX (GRPS eXchange Network) with the novel feature of commu
GTPDOOR is a Windows malware family operated by LightBasin.
Background
According to haxrob, GTPDOOR is Linux malware designed for deployment on telecom-network systems adjacent to the GRX (GRPS eXchange Network), notable for tunneling its C2 traffic inside GTP-C (GPRS Tunnelling Protocol - Control Plane) signalling messages. This technique lets the C2 traffic hide among legitimate signalling and take advantage of ports that are already permitted and exposed to the GRX network.
Source: Malpedia (Fraunhofer FKIE).