Loading malware…
Go2Tunnel is a Go-based SSH reverse-tunneling utility used by the threat cluster tracked as Armored Likho, also known as Eagle Werewolf, to provide covert remote access into compromised Windows systems. It is designed to expose a victim host’s local SSH service to attacker-controlled infrastructure by launching SSH with reverse port forwarding and maintaining tunnel availability over time. The tool has been observed as part of multi-stage intrusion chains involving phishing-delivered droppers and follow-on remote access tooling.
Operationally, Go2Tunnel reads tunnel parameters from local configuration data and can either use a predefined remote tunnel port or request one dynamically from a remote web service. It then starts an SSH reverse tunnel that forwards an externally reachable port on the attacker side to the victim’s local SSH endpoint. The utility also monitors tunnel health and, if connectivity fails, terminates and recreates the SSH process to restore access. In observed campaigns, surrounding scripts configured SSH services, deployed keys, and prepared the host for persistent remote administration.
Go2Tunnel has been associated with Eagle Werewolf operations targeting government, industrial, and UAV-related victims, and with later Armored Likho activity against government agencies and the electric power sector in Russia, Kazakhstan, and Brazil. In earlier campaigns it functioned as a standalone tunneling component alongside Rust and Go droppers and AquilaRAT. Later operations incorporated equivalent reverse SSH tunneling functionality directly into BusySnake Stealer, indicating that Go2Tunnel’s role was to furnish persistent remote access and interactive control rather than data theft itself.
The malware has been delivered in phishing and lure-driven campaigns, including archives containing disguised executables and Telegram-distributed lures in some Eagle Werewolf activity. Its use is consistent with post-compromise access enablement, persistence support, and network tunneling on Windows hosts.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Réutilisation de la fonctionnalité de tunnel SSH inversé (précédemment dans Go2Tunnel )
Réutilisation de la fonctionnalité de tunnel SSH inversé (précédemment dans Go2Tunnel )
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat Discovery: A new phishing campaign has been uncovered, tied to an APT group dubbed Armored Likho (also known as Eagle Werewolf).
проверяет, работает ли сервер, при помощи команды ps1: -Command "Get-NetTCPConnection -RemoteAddress <serverHostname> -RemotePort <ServerSshPort> -State Established -OwningProcess <sshProcess_Pid>"
The URL hxxps://battleflight[.]org/download/installer hosted the executable BattleFlight-Install-v11.0.3.exe, a C# dropper disguised as an installer for a drone pilot training simulator.
Subsequently, it attempts to add the new account to the Administrators group.
Большинство файлов — это полный набор для настройки SSH-соединения, публичные и приватные ключи и конфиги. Скрипты... запускают SSHD и ssh-agent, настроив публичный и приватный ключ.
Subsequently, it attempts to add the new account to the Administrators group.
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" -Name $sshUserName -Value 0 -Type DWord
Скрипты выполняют следующие действия: Создают нового юзера с кредами: $sshUserName = "config"
inst_u.ps1 also writes an event... The script then checks for the account $sshUserName and, if necessary, creates it and sets the password generated by common.ps1.
Subsequently, it attempts to add the new account to the Administrators group.
Большинство файлов — это полный набор для настройки SSH-соединения, публичные и приватные ключи и конфиги. Скрипты... запускают SSHD и ssh-agent, настроив публичный и приватный ключ.
Subsequently, it attempts to add the new account to the Administrators group.
They utilize Go2Tunnel alongside obfuscated, modular RATs and infostealers engineered to bypass dynamic analysis.
The dropper contains the EchoGather payload, which is Base64-encoded and XOR-encrypted.
В архиве с громким названием 1С_модуль_заказа_дрон-v11.zip лежит файлик СВЯЗЬ РЭБ список Гум.exe со знакомым всем желтым значком «1С». При запуске файла пользователь видит стандартное окно загрузки «1C:Enterprise 8.3» с последующим открытием базы данных.
At the final stage of execution, the Rust dropper deletes the insider-[a-zA-Z0-9]{6} directory.
В методе InitManifest расшифровывают ресурс _1C_Module.tmp и сохраняют его в папке temp. Расшифровываемый файл оказывается Go-дроппером, который расшифровывает 2️⃣ 3️⃣ файла.
the script adds a configuration string to the registry to hide the new account from the login screen.
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" -Name $sshUserName -Value 0 -Type DWord
handle_start_proxy_command / handle_stop_proxy_command Устанавливает обратный SSH-туннель... handle_remote_control_command ... RustDesk ...
Before BusySnake Stealer, Armored Likho relied on Go2Tunnel to establish a reverse SSH tunnel, but has implemented the functionality into the infostealer...
The updater.exe executable is a Go dropper that unpacks embedded gzip archives and launches final stage loaders.
Impact & Control: This diverse stack enables them to maintain stealthy host control, exfiltrate credentials, and deploy tailored modules.
В случае когда serverTunnelPort не указан, выполняется POST-запрос по следующему адресу: http://<serverHostname>:<ServerWebPort>/tunnel/register
BusySnake способен развернуть обратный SSH-туннель
Also put to use in the attacks is Go2Tunnel to establish a reverse SSH tunnel to a command-and-control (C2) server using a private key.
handle_start_proxy_command / handle_stop_proxy_command Establishes a reverse SSH tunnel using an SSH command and private key previously received from the C2 server.
Тот, в свою очередь, загружает несколько архивов из репозиториев на GitHub... Затем загружается интерпретатор Python версии 3.12 в виде архива python.zip, скрипт get-pip.py, а также архив data.zip с полезной нагрузкой module.pyw.
Tunnel SSH inversé via handle_start_proxy_command (clé privée reçue du C2)
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.