Potential malware on GL.iNet Comet

Just received an alert from my Unifi IDS this morning:

IPS Alert 1: A Network Trojan was detected. Signature ET MALWARE BPFDoor ICMP Echo Request, X:\[COMMAND\] (Inbound). From: 192.168.20.15:0, to: 192.168.20.1:0, protocol: ICMP

Looks like it sent 10 MB of data. Doing some research, I found this blog post: https://www.rapid7.com/blog/post/tr-new-whitepaper-stealthy-bpfdoor-variants/

Running their detection script, I see some concerning activity on the KVM:

==========================================================
Enhanced Linux BPFDoor Detection Script
==========================================================
Host   : kvm
Date   : 2026-05-10_13-39-55
Version: 1.2
==========================================================
[2026-05-10 13:39:55] [INFO] [1/12] Checking /var/run for suspicious zero-byte mutex/lock files
[2026-05-10 13:39:55] [SUCCESS] [1/12] No known suspicious mutex/lock files found
[2026-05-10 13:39:55] [INFO] [2/12] Checking /etc/sysconfig for suspicious auto-start entries
[2026-05-10 13:39:55] [WARN] [2/12] /etc/sysconfig not present; skipping
[2026-05-10 13:39:55] [INFO] [3/12] Inspecting BPF filters via ss -0pb
Netid Recv-Q Send-Q Local Address:Port                 Peer Address:Port
[2026-05-10 13:39:55] [SUCCESS] [3/12] No obvious BPFDoor-like BPF filters found
[2026-05-10 13:39:55] [INFO] [4/12] Checking RAW and packet socket usage (SOCK_RAW / SOCK_DGRAM)
[2026-05-10 13:39:55] [SUCCESS] No suspicious RAW/packet socket usage detected
[2026-05-10 13:39:55] [INFO] [5/12] Checking for suspicious environment variables
[2026-05-10 13:39:58] [SUCCESS] [5/12] No processes with the full suspicious env var set found
[2026-05-10 13:39:58] [INFO] [6/12] Checking TCP ports 42391-43390 and 8000
[2026-05-10 13:39:58] [ALERT] [6/12] Potentially suspicious connections on historical BPFDoor ports:
tcp        0      0 192.168.20.15:42584     217.160.165.240:80      CLOSE_WAIT  807/connmand

[2026-05-10 13:39:58] [INFO] [7/12] Checking for masqueraded processes (Verifying true execution paths)
[2026-05-10 13:40:17] [CRITICAL] [7/12] Process Masquerading Detected! PID=122 claims to be '/sbin/udevd' but is actually executing '/rom/sbin/udevd'
[2026-05-10 13:40:35] [INFO] [8/12] Checking for processes executing deleted binaries (Fileless execution)
[2026-05-10 13:40:35] [SUCCESS] [8/12] No critical memory-resident/deleted binary execution found
[2026-05-10 13:40:35] [INFO] [9/12] Checking kernel stacks for raw socket blocking (packet_recvmsg/wait_for_more_packets)
[2026-05-10 13:40:35] [SUCCESS] [9/12] No processes blocking on suspicious packet socket kernel functions
[2026-05-10 13:40:35] [INFO] [10/12] Checking for active connections to known BPFDoor C2 domains
[2026-05-10 13:40:35] [WARN] [10/12] 'dig' or 'ss' missing; skipping C2 connection checks.
[2026-05-10 13:40:35] [INFO] [11/12] Checking specific processes for hardcoded BPFDoor file signatures
[2026-05-10 13:40:35] [SUCCESS] [11/12] No hardcoded process signatures detected
[2026-05-10 13:40:35] [INFO] [12/12] Deep scanning candidate binaries (hash, strings, UPX packing)
[2026-05-10 13:40:35] [INFO] >>> Analyzing candidate binary: /rom/sbin/udevd
[2026-05-10 13:40:36] [INFO] >>> Analyzing candidate binary: /usr/sbin/connmand
[2026-05-10 13:40:36] [INFO] [-] Basic persistence triage (cron, systemd, rc scripts)

I am far from a cyber security expert, but this seems super concerning.