Chinese APT Gelsemium Deploys 'Wolfsbane' Linux Variant

The report describes Gelsemium-linked malware evolution: Wolfsbane (a Linux port of the Gelsevirine backdoor incorporating a Unix rootkit) and Firewood (a Linux backdoor with a kernel‑level rootkit derived from the long-running 'Project Wood') have been observed, with samples uploaded to VirusTotal and evidence that attackers exploit Java/Tomcat vulnerabilities to gain access. The article frames these findings within a broader surge in Linux-targeted attacks as adversaries build cross-platform tooling to target enterprise Linux servers and cloud infrastructure.