Loading malware…
Gomir is a Go-based Linux remote access Trojan and backdoor used by the North Korea-linked threat actor Kimsuky, also known as APT43. It is a Linux-targeting variant of GoBear and has been deployed through trojanized software installers and following exploitation of compromised servers. During campaigns against South Korean groupware software vendors in 2025 and early 2026, attackers installed Gomir after gaining initial access, including through a remote code execution vulnerability in an internet-exposed mail server. Gomir was also identified on a downstream SaaS customer's server.
Gomir supports 17 command codes covering shell execution, directory operations, system information collection, TCP connectivity testing, bidirectional file transfer, proxy management, sleep, and hibernation. Its reverse-proxy functionality enables connections to arbitrary endpoints within victim networks and uses SSL to protect communications, supporting internal network pivoting. File-transfer and command-result submission functions enable data exfiltration and delivery of additional payloads.
Persistence depends on execution privileges: Gomir installs a systemd service when running as root and a cron job when running without root privileges. It derives a bot identifier from host attributes and uses local TCP port binding to prevent duplicate execution. Command-and-control traffic uses HTTPS POST requests with URL-safe Base64 encoding and a custom byte-wise encryption scheme. Analyzed samples have been packed with UPX. Related Linux backdoors BirdTroy and DriveTroy share Gomir's code or persistence logic while introducing different command-and-control transports.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Kimsuky has been observed deploying a new Linux backdoor named Gomir, a variant of the GoBear backdoor.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
Vendor A (novembre 2025) : exploitation d’une vulnérabilité RCE sur un serveur de messagerie exposé sur Internet, ayant conduit à l’installation de Gomir.
state-sponsored threat actors and financially motivated attackers are employing a combination of supply chain attacks... After achieving the Initial Breach through phishing, social engineering, and supply chain attacks
| Tactics | Techniques | ... | Initial Access | T1566 : Phishing - nT1190 : Exploit Public - Facing Application - nT1199 : Trusted Relationship |
"국내 그룹웨어 대상 북한 APT 공격 분석" published by ENKI. #Kimsuky, #Phishing, #Slides, #Gomir, #HttpTroy
Persistance via systemd (root) ou crontab (non-root)
Supporte 17 codes de commande : shell, transfert de fichiers, proxy, hibernation, etc.
| Tactics | Techniques | ... | Execution | T1059 . 004 : Command and Scripting Interpreter : Unix Shell - nT1204 . 002 : User Execution : Malicious File |
Persistance via systemd (root) ou crontab (non-root)
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
Persistance via systemd (root)... se copie sous /var/log/rsyslogd
Persistance via systemd (root) ou crontab (non-root)
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
Persistance via systemd (root)... se copie sous /var/log/rsyslogd
Gomir # Backdoor Linux écrit en Go , packé avec UPX
Configuration chiffrée en RC4 ... + Base64 URL-safe, stockée en fin de fichier
persistance via tâche planifiée nommée AhnlabUpdate
Deletes the original ... Deletes cron.txt ... BirdTroy ... delete | Bird_module_shell . Selfdelete | Self-delete ... DriveTroy ... 06 | Die | Self-delete and terminate
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
chiffrement XOR mod 255 + Base64 URL-safe
| Tactics | Techniques | ... | Credential Access | T1056 . 003 : Input Capture : Web Portal Capture |
T1016 — System Network Configuration Discovery (Discovery)
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.
T1049 — System Network Connections Discovery (Discovery)
Génère un bot ID au format XX-[0-9a-f]{10} basé sur MD5 (username + hostname + MAC)
T1083 — File and Directory Discovery (Discovery)
| Tactics | Techniques | ... | Lateral Movement | T1021 : Remote Services - nT1078 : Valid Accounts - nT1570 : Lateral Tool Transfer |
30 | Process_Upload | Transfer a file from the C & C server to the victim system | 31 | Process_Download | Transfer a file from the victim system to the C & C server
31 | Process_Download | Transfer a file from the victim system to the C & C server ... DriveTroy ... 03 | UploadFile | Upload a file from the victim's PC to Google Drive
| Tactics | Techniques | ... | Credential Access | T1056 . 003 : Input Capture : Web Portal Capture |
T1113 — Screen Capture (Collection)
Once it gains unauthorized access, Gomir establishes a persistent presence by communicating with a remote command-and-control (C2) server.
Communication C2 via HTTPS POST ... Utilise Google Drive comme canal C2
Déploiement d’un outil proxy basé sur yamux pour pivoter vers des segments réseau isolés
Additionally, Gomir can download and install further malicious payloads, facilitating broader cyber-espionage or destructive activities.
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
Communication via paquets custom encodés en Base64
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Configuration chiffrée en RC4 ... chiffrement XOR mod 255
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
When sending command results ... encrypted execution result ... BirdTroy ... Command / result ... DriveTroy ... encrypts the execution result with RC4 ... uploads it to Google Drive under the filename E8C46207.res
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.