Gopuram

Gopuram is a malicious software or malware that infiltrates systems to exploit and cause damage. It has been known to infect systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. Prior to Gopuram's introduction, another malware named LPEClient was used to deliver subsequent malware. However, Gopuram has recently been deployed through a 3CX supply-chain attack, demonstrating tactics similar to those used in past attacks. What makes the Gopuram case remarkable is its coexistence with AppleJeus, another backdoor malware attributed to the Lazarus group, on victim machines. This discovery came about following the infamous 3CX hack, which affected victims globally. The Gopuram malware loads a 'ualapi.dll' file after each system reboot, a tactic previously observed with this type of malware. The recent discovery of new Gopuram infections has allowed researchers to link the 3CX campaign to the Lazarus threat actor with medium to high confidence. This financially motivated campaign leveraged the Gopuram malware, further solidifying its association with the 3CX supply chain attack. As such, Gopuram represents a significant cybersecurity threat that requires comprehensive countermeasures.