Springtail: New Linux Backdoor Added to Toolkit

Date (as written): 16 May 2024
Year: 2024

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Organizations in South Korea · 16/05/2024

Researchers from Symantec reveal the details of a campaign orchestrated by the North Korean group Kimsuki, using a new Linux malware called Gomir that is a version of the GoBear backdoor delivered via trojanized software installers. [Date Occurred: Since at least 10/01/2024; Date Discovered: 10/01/2024]

https://www.hackmageddon.com/2024/08/27/16-31-may-2024-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/kimsuky-hackers-deploy-new-linux-backdoor-in-attacks-on-south-korea/

Symantec / Broadcom Threat Hunter Team (security.com)

Springtail: New Linux Backdoor Added to Toolkit · 16 May 2024

More than one legitimate software package was modified to deliver malware in North Korean group’s recent campaign against South Korean organizations.

https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage

Suggest a correction on GitHub