#gelsemium — Public Fediverse posts

China-linked APT Gelsemium uses a new Linux backdoor dubbed WolfsBane – Source: securityaffairs.com https://ciso2ciso.com/china-linked-apt-gelsemium-uses-a-new-linux-backdoor-dubbed-wolfsbane-source-securityaffairs-com/ #rssfeedpostgeneratorecho #Gelsemium Linuxbackdoor #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #BreakingNews #Intelligence #SecurityNews #hackingnews #Hacktivism #Gelsemium #WolfsBane #hacking #Malware #LINUX

The best part of studying the #WolfsBane (#Gelsemium) #Malware samples is the cornucopia of malicious behaviors it has to learn from: from discovery to evasion to persistence. It's my first time seeing ELF binaries with critical content hidden in wide character encoding (16-bit little endian) and multiple concatenated ELF programs in a single file.

... but what's with the `en_US.UTF-8` reference?

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

I hope everyone is having a good weekend!

The Palo Alto Networks Unit 42 research team discovered some activity that they attributed to a very stealthy and rarely seen APT, #Gelsemium. They target a diverse group of industries but use tools like #CobaltStrike, #MetaSploit, and #ChinaChopper but also used the Potato Suite that was seen as JuicyPotato.exe (who can't appreciate that?!). This was a great weekend read and I hope you all enjoy it as much as I did! Happy Hunting!

Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government
https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government https://unit42.paloaltonetworks.com/rare-possible-gelsemium-attack-targets-se-asia/ #BehavioralThreatProtection #AdvancedURLFiltering #ChinaChopper #threatactors #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #backdoor #WildFire #APT

Unit42: Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government https://unit42.paloaltonetworks.com/analysis-of-three-attack-clusters-in-se-asia/ #BehavioralThreatProtection #ThreatProtection #StatelyTaurus #ChinaChopper #CobaltStrike #MustangPanda #threatactors #AlloyTaurus #CL-STA-0044 #CL-STA-0045 #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #WildFire #GALLIUM #APTs