North Korean Hackers Unleash Gomir: The Sinister Linux Backdoor Revealed by Symantec

Hot Take:

Oh, Kimsuky, you sly digital fox! Not content with your old tricks, you’ve now shifted your espionage talents to the Linux arena with a shiny new backdoor named Gomir. Is it a bird? Is it a plane? No, it’s just a forked version of GoBear because why invent new malware when you can give old malware a fresh coat of paint?

• Kimsuky, a North Korean state-sponsored group also known as Thallium or Velvet Chollima, has unleashed a new backdoor, Gomir, targeting Linux devices.
• Gomir is essentially a revamped version of the GoBear backdoor, with similar features like direct C2 communication and the ability to run arbitrary shell commands.
• Typically targeting high-value entities in South Korea, the US, Japan, and others, Kimsuky engages in cyber espionage rather than financial theft.
• The group’s favorite trick, spear phishing, remains the top method for deploying their malware.
• Education on spotting and responding to phishing emails is the best defense against Kimsuky’s nefarious activities.

Need to know more?

Same Old Song, Just a Different Dance

If you thought malware innovation was on the agenda for North Korean hackers, think again. Kimsuky’s latest tool, Gomir, is basically the malware equivalent of reheating last night’s pizza. Sure, it gets the job done, but it’s hardly groundbreaking. This backdoor retains all the classic hits from its predecessor GoBear, including the ability to probe network endpoints and exfiltrate juicy files from compromised systems.

The Espionage Connoisseurs

Kimsuky isn’t just dabbling in cyberattacks for kicks; they’re in it for the long haul with a decade of digital snooping under their belts. Their primary targets? Think tanks, universities, vaccine developers during the Covid-19 pandemic, and the energy sector. It’s like watching a spy thriller, but you’re potentially in it, and there’s no popcorn.

A Phishing We Will Go

The number one tool in Kimsuky’s nefarious toolkit remains good ol’ phishing. It’s not sophisticated, but why fix what isn’t broken? The best countermove isn’t a shiny new tech gadget but good, old-fashioned education. Teaching employees to spot and dodge those crafty phishing attempts is your best bet in keeping Kimsuky out of your digital cookie jar.

What’s Next? A Seminar on Cyber Manners?

With Kimsuky’s relentless focus on high-profile targets and their penchant for repurposing old malware tricks, one might wonder if they’ll ever switch tactics or perhaps host a webinar on effective phishing techniques. Until then, keep those digital literacy skills sharp, and remember, not every email is your friend!

In a digital world where North Korean hackers keep coming up with remixes of their greatest hits, staying informed and vigilant is the new normal. So next time you get an email from a prince asking for your credentials in exchange for a fortune, just press delete. It’s probably Kimsuky trying to slide into your Linux server DMs.