BlueShell Used in Attacks Against Linux Systems in Korea (2)

AhnLab ASEC details BlueShell, a Go-written backdoor actively used in targeted attacks on Linux systems (primarily Korea and Thailand). The report covers customized variants that load configuration from environment variables, memory-only execution via an XOR-encrypted dropper, a parent dropper disguised as the Linux `id` command to maintain persistence, TLS-protected C2 communications, and provides confirmed samples, MD5 hashes, and C2 URLs/hosts as IoCs.