Gelsemium’s Shift to Linux Malware with WolfsBane and FireWood (Campaign)
ID: e2ef6a7f-63ac-5d77-b4fe-fa2dd9aa4401
STIX ID: report--e2ef6a7f-63ac-5d77-b4fe-fa2dd9aa4401
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2024-11-21
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
ESET researchers uncovered two Linux backdoors—WolfsBane (high-confidence link to Gelsemium) and FireWood (low-confidence link)—plus web shells, rootkits, and a trojanized SSH client used to maintain persistent access and exfiltrate sensitive data; samples were discovered during incident response in East Asia, indicating targeted, sophisticated cyberespionage activity.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.