Gelsemium

Gelsemium is a sophisticated malware associated with Advanced Persistent Threat (APT) activities. It is known for its stealthy operations and the use of server-side exploits to deploy a web shell and multiple custom tools on targeted systems. The malware has been used in cyber-attacks against various organizations, including those in Palestine, Tajikistan, Kyrgyzstan, and more recently, it is suspected to be behind a targeted attack on a Southeast Asian Government. The Gelsemium group utilizes both custom and public tools in their operations, often deploying them with stealth techniques and technologies. One such tool identified is 'EarthWorm', an open-source SOCKS proxy tunneller available on GitHub. This tool has been utilized by multiple China-linked APT groups in the past, including 'Volt Typhoon', 'APT27', and 'Gelsemium' itself. The group's modus operandi typically involves server-side exploitation, leading to the creation of a webshell which then allows for further infiltration and control over the compromised system. In recent times, Gelsemium has featured prominently in cyber threat landscapes. Notably, it was highlighted in the same quarter as Kimsuky's usage of the Golang-based backdoor Durian in a supply-chain attack in South Korea, and other campaigns focused on the Middle East. These instances indicate the active and persistent nature of Gelsemium, making it a significant threat to cybersecurity worldwide.