OMClientService.exe

OMClientService.exe is a Golang backdoor used by the Türkiye-affiliated espionage group Marbled Dust, also tracked as Sea Turtle, UNC1326, Silicon, Cosmic Wolf, and Teal Kurma. It was deployed in a campaign targeting users associated with the Kurdish military in Iraq through exploitation of Output Messenger vulnerability CVE-2025-27920, a directory traversal flaw affecting Output Messenger v2.0.62. Microsoft reported the activity began in April 2024.

On compromised Windows client systems, an installer extracted and executed both the legitimate OutputMessenger.exe and OMClientService.exe. The malware is described as a second Go-based backdoor used on client devices, while a related server-side backdoor, OMServerService.exe, was deployed on Output Messenger servers. Microsoft assessed Marbled Dust likely first obtained authenticated access to the Output Messenger Server Manager interface, potentially via DNS hijacking or typosquatted domains used to intercept credentials, and then leveraged the vulnerability to deploy payloads.

OMClientService.exe connected to a Marbled Dust command-and-control domain and, in at least one observed case, to an IP address previously linked to the group. Reported behavior included command execution and collection of files into a RAR archive on the desktop, consistent with data exfiltration objectives. The broader campaign enabled access to communications, user impersonation, operational disruption, and theft of user data from targets in Iraq. High-confidence associated indicators and artifacts mentioned in the reporting include the malware name OMClientService.exe, its use alongside OutputMessenger.exe on client devices, and its association with Marbled Dust’s Output Messenger exploitation activity.