Gelsemium

Gelsemium is a type of malware, a malicious software designed to infiltrate and damage computer systems. It can be introduced into a system through suspicious downloads, emails, or websites, often without the user's knowledge. Once it has gained access, Gelsemium has the ability to steal personal information, disrupt operations, or even hold data hostage for ransom. There have been repeated instances suggesting that Gelsemium APT (Advanced Persistent Threat) is behind targeted attacks on Southeast Asian governments. The Gelsemium APT group is known for its sophisticated attacks and has been linked to various cyber espionage campaigns. In these instances, the malware was likely used to extract sensitive information from government databases, causing significant disruption and potential security risks. In addition to the Southeast Asian governments, Gelsemium has also been implicated in server-side exploits against organizations in Palestine, Tajikistan, and Kyrgyzstan. These attacks typically involve deploying a web shell and multiple custom tools. Furthermore, Gelsemium has been associated with 'EarthWorm', an open-source SOCKS proxy tunneller available on GitHub, which has been utilized by multiple China-linked APT groups including 'Volt Typhoon', 'APT27', and 'Gelsemium' itself.