EXECUTIVE SUMMARY
A newly discovered Linux backdoor, dubbed Linux.Gomir, has been unveiled. This malware is attributed to the North Korean Springtail espionage group, also known as Kimsuky. Linked to recent campaigns targeting organizations in South Korea, Linux.Gomir shares structural similarities with the GoBear backdoor, previously utilized by Springtail in Windows environments. This revelation underscores the group's ongoing evolution and persistence in employing advanced cyber threats for espionage purposes.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
A newly discovered Linux backdoor, dubbed Linux.Gomir, has been unveiled. This malware is attributed to the North Korean Springtail espionage group, also known as Kimsuky. Linked to recent campaigns targeting organizations in South Korea, Linux.Gomir shares structural similarities with the GoBear backdoor, previously utilized by Springtail in Windows environments. This revelation underscores the group's ongoing evolution and persistence in employing advanced cyber threats for espionage purposes.[emaillocker id="1283"]
Linux.Gomir is structurally like the GoBear backdoor and shares extensive code with it. It is designed to install itself with persistence on Linux systems, utilizing techniques such as creating a systemd service or configuring a crontab entry. Once installed, Gomir communicates with its command-and-control server, executing various commands including shell commands, network probing, and file manipulation. It also supports features like pausing communication with the C&C server and starting a reverse proxy for remote access.
This discovery underscores the evolving tactics of North Korean espionage actors, particularly their focus on supply chain attacks and Trojanized software installers. The use of legitimate certificates and the adaptation of malware across different platforms demonstrate these threat actors. Organizations, particularly those in South Korea, should remain vigilant and implement robust security measures to mitigate the risks posed by such threats.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1566 | Phishing |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| Defense Evasion | T1562 | Impair Defenses |
| Credential Access | T1552 | Unsecured Credentials |
| Discovery | T1018 | Remote System Discovery |
| T1083 | File and Directory Discovery | |
| T1046 | Network Service Discovery | |
| Exfiltration | T1020 | Automated Exfiltration |
| T1041 | Exfiltration Over C2 Channel | |
| Impact | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery |
REFERENCES:
The following reports contain further technical details:
[/emaillocker]