Loading malware…
Gomir is a Go-based Linux remote access trojan and backdoor associated with Kimsuky and assessed as a Linux-targeting variant within the GoBear malware lineage. It has been used after initial compromise of internal infrastructure, including in operations targeting a South Korean groupware vendor. Gomir is designed to provide persistent remote control over compromised Linux systems and to support follow-on intrusion activity inside victim environments.
On execution, Gomir either enters an installation routine or begins its command-and-control loop. It establishes persistence through Linux-native mechanisms, creating a systemd service when running with root privileges and falling back to cron-based persistence when running without elevated privileges. It also includes duplicate-execution prevention logic and generates a host-specific bot identifier derived from local system attributes.
For command and control, Gomir communicates over HTTPS and uses URL-safe Base64 together with a custom encryption scheme to protect tasking and results in transit. It also supports reverse proxy functionality over SSL-encrypted channels, allowing operators to relay traffic and initiate connections to arbitrary internal network endpoints through the infected host. This makes the malware useful not only for remote administration but also for internal pivoting and access into segmented environments.
Gomir supports a broad set of post-compromise capabilities, including shell command execution, directory and file operations, bidirectional file transfer, system information collection, sleep and hibernation controls, and TCP connectivity testing against arbitrary endpoints. These features enable reconnaissance, remote operations, data movement, and lateral-enablement functions typical of an espionage-oriented Linux backdoor. Analysis of its command set also indicates code lineage from a Windows counterpart, with at least one command stub left unimplemented on Linux.
Gomir has been tracked in relation to Kimsuky activity and has close relationships with other Linux malware families such as BirdTroy and DriveTroy, which reuse or extend its persistence logic, communications patterns, and operator tradecraft. Its combination of Linux persistence, encrypted web-based C2, proxying, and remote execution makes it a flexible platform for sustained access and follow-on operations in targeted enterprise environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant
28 distinct techniques documented for this family, organized by ATT&CK tactic.
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
| Tactics | Techniques | ... | Initial Access | T1566 : Phishing - nT1190 : Exploit Public - Facing Application - nT1199 : Trusted Relationship |
"Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant" ... #Kimsuky, #SupplyChain, #Gomir, #HttpTroy
루트 권한이 아니라면 아래 과정을 거쳐 크론탭 방식으로 지속성을 확보한다. crontab -l 로 기존 내용을 읽고, */10 * * * * <자기 경로> 항목을 붙여 cron.txt 에 기록
If the first byte of the server response is S (0x53), the remainder is decoded as URL-safe Base64... The first 4 bytes of the decoded result serve as the decryption key... DriveTroy ... configuration data is RC4-encrypted and then encoded with the URL-safe Base64
/var/log/rsyslogd 로 자기 복사 ... /etc/systemd/system/rsyslogd.service 유닛 작성 ... DriveTroy ... 서비스명 | syslogd , logd , cachelogd , cachemond , monlogd 중 랜덤 선택
Deletes the original ... Deletes cron.txt ... BirdTroy ... delete | Bird_module_shell . Selfdelete | Self-delete ... DriveTroy ... 06 | Die | Self-delete and terminate
05 | Process_Conn | TCP connection test ... DriveTroy ... 07 | ConnCheck | TCP connection test
Gomir uses HTTPS POST in its main communication loop with the C&C server ... BirdTroy ... sends it via HTTP POST ... DriveTroy ... polls commands by downloading the E8C46207.cmd file from Google Drive every second
14 | Process_PForward_Add | 프록시 추가 | 15 | Process_PForward_List | 프록시 목록 조회 ... 14 , 15 의 프록시 기능은 앞서 yamux 기반 프록시 도구와 사실상 동일한 기능을 수행한다.
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
서버 응답의 첫 바이트가 S (0x53)이면 나머지를 ... URL-safe Base64로 디코딩한다 ... 결과 전송 시 ... URL-safe Base64로 인코딩한다. ... BirdTroy는 커스텀 패킷을 구성하여 C&C 서버와 통신한다. 패킷 전체를 Base64로 인코딩한 뒤 ... 전송한다.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A new Gomir family variant reportedly used by Kimsuky in an attack against a South Korean groupware developer, in a phishing and supply-chain context.
Gomir is the named malware family discussed in the post; it is referenced as a new variant used in a Kimsuky supply-chain attack against a South Korean groupware vendor.
Go-based Linux RAT/backdoor installed after initial compromise. It establishes persistence via systemd or crontab, prevents duplicate execution by binding local TCP ports, communicates with its C2 over HTTPS POST, executes shell commands, gathers system information, supports proxying, and transfers files.
Go-based Linux backdoor used for persistence, command execution, file transfer, proxying, and C2 over HTTPS POST. It establishes persistence via systemd when running as root or crontab otherwise, generates a bot ID from host attributes, and supports shell commands, system discovery, proxy functions, and upload/download operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.