Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor

The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia.

That’s according to findings from cybersecurity firm ESET based on multiple Linux samples uploaded to the VirusTotal platform from Taiwan, the Philippines, and Singapore in March 2023.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

WolfsBane has been assessed to be a Linux version of the threat actor’s Gelsevirine backdoor, a Windows malware put to use as far back as 2014. Also discovered by the company is another previously undocumented implant named FireWood that’s connected to another malware toolset known as Project Wood.

FireWood has been attributed to Gelsemium with low confidence, given the possibility that it could be shared by multiple China-linked hacking crews.

“The goal of the backdoors and tools discovered is cyber espionage targeting sensitive data such as system information, user credentials, and specific files and directories,” ESET researcher Viktor Šperka said in a report shared with The Hacker News.

“These tools are designed to maintain persistent access and execute commands stealthily, enabling prolonged intelligence gathering while evading detection.”

The exact initial access pathway used by the threat actors is not known, although it’s suspected that the threat actors exploited an unknown web application vulnerability to drop web shells for persistent remote access, using it to deliver the WolfsBane backdoor by means of a dropper.

Besides using the modified open-source BEURK userland rootkit to conceal its activities on the Linux host, it’s capable of executing commands received from an attacker-controlled server. In a similar vein, FireWood employs a kernel driver rootkit module called usbdev.ko to hide processes, and run various commands issued by the server.

The use of WolfsBane and FireWood is the first documented use of Linux malware by Gelsemium, signaling an expansion of the targeting focus.

“The trend of malware shifting towards Linux systems seems to be on the rise in the APT ecosystem,” Šperka said. “From our perspective, this development can be attributed to several advancements in email and endpoint security.”

“The ever-increasing adoption of EDR solutions, along with Microsoft’s default strategy of disabling VBA macros, are leading to a scenario where adversaries are being forced to look for other potential avenues of attack.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.