S1184 BOLDMOVE
BOLDMOVE is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. BOLDMOVE includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. BOLDMOVE is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs.1 The record for BOLDMOVE only covers known Linux variants.
| Item | Value |
|---|---|
| ID | S1184 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.0 |
| Created | 31 December 2024 |
| Last Modified | 15 April 2025 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1071 | Application Layer Protocol | - |
| enterprise | T1071.001 | Web Protocols | BOLDMOVE uses web services for command and control communication.1 |
| enterprise | T1059 | Command and Scripting Interpreter | - |
| enterprise | T1059.004 | Unix Shell | BOLDMOVE is capable of spawning a remote command shell.1 |
| enterprise | T1554 | Compromise Host Software Binary | BOLDMOVE contains a watchdog-like feature that monitors a particular file for modification. If modification is detected, the legitimate file is backed up and replaced with a trojanized file to allow for persistence through likely system upgrades.1 |
| enterprise | T1543 | Create or Modify System Process | BOLDMOVE can free all resources and terminate itself on victim machines.1 |
| enterprise | T1573 | Encrypted Channel | - |
| enterprise | T1573.002 | Asymmetric Cryptography | BOLDMOVE uses the WolfSSL library to implement SSL encryption for command and control communication.1 |
| enterprise | T1480 | Execution Guardrails | BOLDMOVE verifies it is executing from a specific path during execution.1 |
| enterprise | T1190 | Exploit Public-Facing Application | BOLDMOVE is associated with exploitation of CVE-2022-49475 in FortiOS.1 |
| enterprise | T1083 | File and Directory Discovery | BOLDMOVE can list information of all files in the system recursively from the root directory or from a specified directory.1 |
| enterprise | T1564 | Hide Artifacts | - |
| enterprise | T1564.011 | Ignore Process Interrupts | BOLDMOVE calls the signal function to ignore the signals SIGCHLD, SIGHIP, and SIGPIPE prior to starting primary logic.1 |
| enterprise | T1562 | Impair Defenses | BOLDMOVE can modify proprietary Fortinet logs on victim machines.1 |
| enterprise | T1562.006 | Indicator Blocking | BOLDMOVE can disable the Fortinet daemons moglogd and syslogd to evade detection and logging.1 |
| enterprise | T1070 | Indicator Removal | - |
| enterprise | T1070.004 | File Deletion | BOLDMOVE can remove files on victim systems.1 |
| enterprise | T1090 | Proxy | - |
| enterprise | T1090.003 | Multi-hop Proxy | BOLDMOVE is capable of relaying traffic from command and control servers to follow-on systems.1 |
| enterprise | T1082 | System Information Discovery | BOLDMOVE performs system survey actions following initial execution.1 |
| enterprise | T1016 | System Network Configuration Discovery | BOLDMOVE enumerates network interfaces on the infected host.1 |