Loading story…
Attackers distributed a modified GoBot2 backdoor, dubbed GoBotKR, through torrent sites by disguising malware as Korean movies, TV shows, and some games. Victims were lured into opening deceptive .lnk shortcut files or executables made to look legitimate, after which the malware installed a backdoor, collected host information, and connected to command-and-control servers hosted in South Korea for remote control of infected systems.
The malware appeared primarily designed to build a botnet for DDoS activity, but it also supported persistence, self-updating, proxy functions, torrent seeding, removable-media propagation, and spread via cloud-synced folders. Researchers said the Go-based threat was adapted for South Korean targets, including checks using local services such as Naver and Daum and logic referencing AhnLab security products; telemetry indicated activity since March 2018, with most detections in South Korea and additional cases in China and Taiwan.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
ESET telemetry indicates the GoBotKR malware campaign distributing a modified GoBot2 backdoor through torrent sites has been active since March 2018. The campaign primarily targeted South Korean users with lures themed as Korean movies, TV shows, and games.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 154 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple malware campaigns that disguised executables as document files to trick users into launching backdoors. In one case, attackers used a file named **"2021년 국방부 업무보고 수정.pif"** that appeared to be a revised South Korean Ministry of National Defense report; when opened, it displayed a legitimate PDF while silently dropping a malicious DLL to `C:\ProgramData\Intel\Driver\driver.cfg`, executing it with **`regsvr32.exe`**, and creating a scheduled task named **`Disk0`** to run every 30 minutes. The payload was identified as a downloader that contacted command-and-control infrastructure for follow-on instructions. A separate campaign used a malicious **SCR** file signed with a valid certificate from a well-known Korean company and presented with a PDF-like icon to reduce suspicion. After execution, the malware opened a decoy PDF from `%TEMP%`, extracted a DLL named `config.dat` into `C:\Users\Public\`, launched it with **`rundll32.exe`**, and deleted the original dropper. The backdoor then established persistence either through a **`MicrosoftEdgeInstaller`** service or a registry key, decrypted embedded configuration data with **RC4** when needed, and connected to its C2 server to support file transfer, process execution, screenshot capture, configuration updates, and code injection.
Aug 15, 2026
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026
South Korean authorities and AhnLab disclosed **Operation Double Barrel**, a campaign that targeted Korean citizens and businesses from 2025 through the first half of 2026 by exploiting vulnerabilities in Korean financial security software. The activity used **watering hole** and **spear-phishing** attacks to direct victims to malicious URLs, after which attackers deployed backdoors including **Struggle** (also tracked as `SIGNBT 3.0`) and **Brandoor** (`COPPERHEDGE`). Legitimate Korean websites in media, education, healthcare, and manufacturing were abused as part of the watering hole infrastructure, and investigators said the pattern also raised possible **supply-chain** concerns tied to a shared website development and management company. The same software flaws were also used in separate intrusions that delivered **Gunra ransomware**, leading to file encryption and data exfiltration. A joint cybersecurity advisory issued by South Korea's **National Intelligence Service**, **National Police Agency**, **Korea Internet & Security Agency**, and **Financial Security Institute** said overlapping vulnerabilities, malware characteristics, SSH key fingerprints, and network infrastructure indicate possible limited collaboration or shared tooling between a state-sponsored threat actor and the Gunra ransomware group, although the relationship has not been confirmed definitively.
Aug 3, 2026