<\/div>\n

Symantec warns of a new Linux backdoor used by the North Korea-linked Kimsuky APT in a recent campaign against organizations in South Korea.\u00a0<\/h2>\n\n\n\n

Symantec researchers observed the North Korea-linked group Kimsuky<\/a> using a new Linux backdoor dubbed Gomir. The malware is a version of the GoBear backdoor which was delivered in a recent campaign by Kimsuky via Trojanized software installation packages.<\/gwmw><\/p>\n\n\n\n

Kimsuky\u00a0cyberespionage group\u00a0<\/a>(aka Springtail,\u00a0ARCHIPELAGO, Black Banshee,\u00a0Thallium<\/a>, Velvet Chollima,\u00a0APT43<\/a>) was first\u00a0spotted<\/a>\u00a0by Kaspersky researcher in 2013. <\/gwmw>The APT group mainly targets think tanks and organizations in South Korea, other victims were in the United States, Europe, and Russia.<\/gwmw><\/p>\n\n\n\n

In 2023 the state-sponsored group focused on nuclear agendas between China and North Korea, relevant to the ongoing war between Russia and Ukraine.<\/gwmw><\/p>\n\n\n\n

Gomir and GoBear share a great portion of their code.<\/p>\n\n\n\n

Researchers from South Korean security firm S2W first uncovered<\/a> the compaign in February 2024, the threat actors were observed delivering a new malware family named Troll Stealer using Trojanized software installation packages. Troll Stealer supports multiple stealing capabilities, it allows operators to gather files, screenshots, browser data, and system information. The malicious code is written in Go, and researchers noticed that Troll Stealer contained a large amount of code overlap with earlier Kimsuky malware.<\/p>\n\n\n\n

Troll Stealer can also copy the GPKI (Government Public Key Infrastructure) folder on infected computers.\u00a0GPKI is the public key infrastructure schema<\/a>\u00a0for South Korean government personnel and state organizations, suggesting that government agencies were among the targeted by state-sponsored hackers.<\/p>\n\n\n\n

The malware was distributed inside the installation packages for TrustPKI and NX_PRNMAN, software developed by SGA Solutions. Victims downloaded the packages from a page that was redirected from a specific website.\u00a0<\/p>\n\n\n\n

Symantec also discovered that Troll Stealer was also delivered in Trojanized Installation packages for Wizvera VeraPort<\/a>. <\/p>\n\n\n\n

The WIZVERA VeraPort integration installation program is used to manage additional security software (e.g., browser plug-ins, security software, identity verification software, etc.) that is requested to visit particular government and banking domains. WIZVERA VeraPort is used to digitally sign and verify downloads. <\/p>\n\n\n\n

Wizvera VeraPort was\u00a0previously reported to have been compromised<\/a>\u00a0by a supply chain attack conducted by North Korea-linked group Lazarus<\/a>.<\/p>\n\n\n\n

“Troll Stealer appears to be related to another recently discovered Go-based backdoor named GoBear. Both threats are signed with a legitimate certificate issued to \u201cD2innovation Co.,LTD\u201d. GoBear also contains similar function names to an older Springtail backdoor known as BetaSeed, which was written in C++, suggesting that both threats have a common origin.” reads the report<\/strong><\/a> published by Symantec.<\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

When executed, the malware checks the group ID value to determine if it is running as group 0 (group is associated with the superuser or administrative privileges) on the Linux machine, and then copies itself to\u00a0\/var\/log\/syslogd<\/em>\u00a0to maintain persistence persistence.<\/p>\n\n\n\n

It creates a systemd service named ‘syslogd’ and starts it, then deletes the original executable and terminates the initial process. The backdoor also attempts to configure a crontab command to run on system reboot by creating a helper file (‘cron.txt’) in the current directory. If the crontab list is successfully updated, the malware deletes the helper file without any command-line parameters before executing it. <\/p>\n\n\n\n

The Gomir backdoor periodically communicates with its C2 via HTTP POST requests to http:\/\/216.189.159[.]34\/mir\/index.php<\/p>\n\n\n\n

The malicious code pools the commands to execute, and the researchers observed it supporting multiple commands. including: <\/p>\n\n\n\n

Operation<\/th>	Description<\/th><\/tr><\/thead>
01<\/td>	Pauses communication with the C&C server for an arbitrary time duration.<\/td><\/tr>
02<\/td>	Executes an arbitrary string as a shell command (“[shell]” “-c” “[arbitrary_string]”). The shell used is specified by the environment variable “SHELL”, if present. Otherwise, a fallback shell is configured by operation 10 below.<\/td><\/tr>
03<\/td>	Reports the current working directory.<\/td><\/tr>
04<\/td>	Changes the current working directory and reports the working directory\u2019s new pathname.<\/td><\/tr>
05<\/td>	Probes arbitrary network endpoints for TCP connectivity.<\/td><\/tr>
06<\/td>	Terminates its own process. This stops the backdoor.<\/td><\/tr>
07<\/td>	Reports the executable pathname of its own process (the backdoor executable).<\/td><\/tr>
08<\/td>	Collects statistics about an arbitrary directory tree and reports: total number of subdirectories, total number of files, total size of files<\/td><\/tr>
09<\/td>	Reports the configuration details of the affected computer: hostname, username, CPU, RAM, network interfaces, listing each interface name, MAC, IP, and IPv6 address<\/td><\/tr>
10<\/td>	Configures a fallback shell to use when executing the shell command in operation 02. Initial configuration value is “\/bin\/sh”.<\/td><\/tr>
11<\/td>	Configures a codepage to use when interpreting output from the shell command in operation 02.<\/td><\/tr>
12<\/td>	Pauses communication with the C&C server until an arbitrary datetime.<\/td><\/tr>
13<\/td>	Responds with the message “Not implemented on Linux!” (hardcoded).<\/td><\/tr>
14<\/td>	Starts a reverse proxy by connecting to an arbitrary control endpoint. The communication with the control endpoint is encrypted using the SSL protocol and uses messages consistent with https:\/\/github.com\/kost\/revsocks.git, where the backdoor acts as a proxy client. This allows the remote attacker to initiate connections to arbitrary endpoints on the victim network.<\/td><\/tr>
15<\/td>	Reports the control endpoints of the reverse proxy.<\/td><\/tr>
30<\/td>	Creates an arbitrary file on the affected computer.<\/td><\/tr>
31<\/td>	Exfiltrates an arbitrary file from the affected computer.<\/td><\/tr><\/tbody><\/table>