Loading story…
Researchers at Solar 4RAYS uncovered a long-running cyber-espionage campaign targeting at least four companies that provide services to Russian government organizations, identifying a previously unseen Golang backdoor dubbed GoblinRAT. The intrusions reportedly ran from at least October 2020 through 2023 and relied on highly stealthy, hands-on-keyboard activity on Linux systems. Investigators said the operators abused built-in Linux utilities, used unique persistence names on each host, masqueraded malicious processes as legitimate services such as Zabbix, memcached, vmtoolsd, cron, and Red Hat subscription components, and in some cases executed malware only in memory. The malware was also hidden as a malicious library loaded into atop, while command-and-control infrastructure used compromised legitimate websites and DDNS services.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Solar 4RAYS publicly reported a long-running cyber-espionage campaign affecting government-sector infrastructure and contractors, describing GoblinRAT's stealth techniques, persistence methods, and command-and-control infrastructure. The researchers said attribution remained unresolved and designated the activity cluster NGC2140.
After the suspicious activity was discovered in spring 2023, the victim organization invited Solar 4RAYS to investigate the incident. The investigation focused on stealthy Linux-based attacker activity in government-sector service providers.
In spring 2023, employees of an IT company serving mainly Russian government bodies detected a dump of user hashes from a domain controller. The hash dump had been performed with impacket-secretsdump launched from a Linux host, after which attackers cleared logs and exfiltrated data.
Solar 4RAYS traced the broader GoblinRAT activity cluster NGC2140 back to a presumed initial compromise in October 2020. Investigators also traced the malware's development history to 2020.
An early 2020 GoblinRAT server variant was identified that listened on a configured interface and required port knocking before accepting connections, showing the malware's stealth-focused design early in its development.
Using command-and-control indicators from GoblinRAT configurations, investigators identified three additional infected organizations beyond the initial victim. In total, at least four companies providing services to government organizations were found infected.
During the investigation, Solar 4RAYS identified a previously unseen Golang malware family and named it GoblinRAT. The backdoor was designed for remote access and concealment on Linux systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Researchers detailed **Klingon RAT**, a Golang-based remote access trojan active since at least 2019 and assessed to be operated by financially motivated cybercriminals. The malware uses extensive custom code and encrypted TLS communications with command-and-control infrastructure, with a primary server identified at `185.188.183[.]144:1141` alongside additional related indicators. Klingon RAT collects host and network information, maintains persistence through multiple mechanisms, and attempts to evade defenses by terminating antivirus processes. The malware gives operators broad post-compromise control, including reverse shell access, SOCKS proxying, RDP, arbitrary binary execution, updates, and PowerShell execution. Researchers also reported several privilege-escalation options, including a UAC bypass technique associated with **Event Viewer**, and said the malware can deploy tools such as **PAExec** and an LSASS memory dumper to expand access and harvest credentials, underscoring its utility as a full-featured intrusion platform.
Aug 14, 2026