Gelsemium

Gelsemium is a highly sophisticated malware associated with an Advanced Persistent Threat (APT) group that has been active since at least 2014. This entity, known for its long-term, targeted attacks, is suspected to be behind a series of cyber-espionage incidents aimed at Southeast Asian governments. The initial access method used by the Gelsemium APT group remains unclear, but it's believed that the attackers exploited an unknown web application vulnerability. This China-linked APT group has deployed a previously unknown Linux backdoor, WolfsBane, in attacks targeting East and Southeast Asia. WolfsBane is a Linux version of Gelsevirine, a Windows backdoor used by Gelsemium APT. It serves as a stealthy loader designed to infiltrate targeted systems and enable the deployment of additional malware modules. Its dropper, equivalent to the Gelsemine dropper, incorporates a concealment mechanism derived from an open-source userland rootkit. These tools mirror Gelsemium’s Windows tools for cyberespionage, targeting sensitive data while evading detection. Alongside WolfsBane, another Linux-ported backdoor, FireWood, was observed. Experts attribute FireWood to Gelsemium with low confidence, considering it could be a tool shared among multiple China-linked APTs. Regardless, these advanced tools have been attributed by ESET to the notorious Gelsemium APT group, a cyber-espionage entity with a history of targeting government, business, and critical infrastructure sectors.