Gelsemium

Gelsemium is a form of malware, short for malicious software, designed to exploit and damage computer systems. It can infiltrate systems via suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Gelsemium can perform a variety of harmful actions such as stealing personal information, disrupting operations, or even holding data hostage for ransom. There have been numerous inquiries regarding whether Gelsemium APT (Advanced Persistent Threat) is behind targeted attacks on Southeast Asian Governments. An Advanced Persistent Threat refers to a network attack in which an unauthorized person gains access to a network and stays there undetected for a long period of time. The intention of an APT attack is usually to monitor network activity and steal data rather than to cause damage to the network or organization. The tool known as SAMRID was identified as 'EarthWorm', an open-source SOCKS proxy tunneller available on GitHub. This tool has been utilized in the past by multiple China-linked APT groups, including 'Volt Typhoon', 'APT27' and 'Gelsemium'. These connections raise concerns about the potential involvement of these groups, particularly Gelsemium, in the reported cyberattacks against Southeast Asian governments.