Linux Malware DISGOMOJI Targets Indian Officials

Volexity reports a targeted cyber-espionage campaign (attributed to UTA0137) against Indian government entities running the BOSS Linux distribution, deploying a Golang ELF loader that installs DISGOMOJI — a Linux backdoor that uses Discord channels and emojis for C2, supports file exfiltration, persistence via cron, USB harvesting, and employs DirtyPipe for privilege escalation; the report includes TTPs, IoCs and YARA rules to aid detection and mitigation.