Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine

ESET researchers found and analyzed Linux backdoors (WolfsBane and FireWood) and related tools in VirusTotal-uploaded archives targeting web servers in East Asia; WolfsBane is attributed with high confidence to the China-aligned Gelsemium APT and includes a dropper, launcher, backdoor and a modified userland rootkit, while FireWood is linked to Project Wood with lower confidence. The report documents persistence mechanisms (systemd services, rc scripts, XDG autostart), C2 communication (UDP/HTTPS/TCP with TEA/RC4 encryption), credential theft (trojanized ssh client), webshells, kernel-module hiding, extensive IoCs, and mapped MITRE ATT&CK techniques to aid detection and response.