Skip to content

S1198 Gomir

Gomir is a Linux backdoor variant of the Go-based malware GoBear, uniquely assoicated with Kimsuky operations.1

Item Value
ID S1198
Associated Names
Type MALWARE
Version 1.0
Created 17 January 2025
Last Modified 17 January 2025
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Gomir periodically communicates to its command and control infrastructure through HTTP POST requests.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.004 Unix Shell Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.1
enterprise T1543 Create or Modify System Process -
enterprise T1543.002 Systemd Service Gomir creates a systemd service named syslogd for persistence.1
enterprise T1132 Data Encoding -
enterprise T1132.001 Standard Encoding Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.1
enterprise T1573 Encrypted Channel Gomir uses a custom encryption algorithm for content sent to command and control infrastructure.1
enterprise T1573.002 Asymmetric Cryptography Gomir uses reverse proxy functionality that employs SSL to encrypt communications.1
enterprise T1083 File and Directory Discovery Gomir collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.1
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion Gomir deletes its original executable and terminates its original process after creating a systemd service.1
enterprise T1069 Permission Groups Discovery -
enterprise T1069.001 Local Groups Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.1
enterprise T1090 Proxy -
enterprise T1090.001 Internal Proxy Gomir can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.1
enterprise T1018 Remote System Discovery Gomir probes arbitrary network endpoints for TCP connectivity.1
enterprise T1053 Scheduled Task/Job -
enterprise T1053.003 Cron Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.1
enterprise T1082 System Information Discovery Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.1
enterprise T1016 System Network Configuration Discovery Gomir collects network information on infected systems such as listing interface names, MAC and IP addresses, and IPv6 addresses.1

Groups That Use This Software

ID Name References
G0094 Kimsuky Gomir is uniquely associated with Kimsuky operations.1

References

  1. Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩