Bulbature, beneath the waves of GobRAT

Sekoia TDR analyzed an active infrastructure that infects and converts internet-exposed edge devices into Operational Relay Boxes (ORBs) using GobRAT (Go-based RAT) and Bulbature (C-based, heavily obfuscated) to provide proxy tunnels, relay attacks (DDoS, exploitation), and reconnaissance; the report details staging servers, installation/management scripts, administration interfaces for GobRAT and proxy provisioning, victimology (~74,944 compromised hosts in an export), and IOCs (IPs, domains, file hashes), and assesses a high-confidence attribution to Chinese-origin operators.