New Linux malware is controlled through emojis sent from Discord

A Volexity report describes DISGOMOJI, a Linux backdoor used in an espionage campaign targeting Indian government desktops (notably the BOSS Linux distribution). The malware is delivered via a UPX-packed ELF in phishing archives, displays a PDF lure while installing additional payloads (including a USB-theft shell script), exfiltrates system information and files, persists via cron/XDG autostart, and is controlled through a Discord emoji-based C2 (using the open-source discord-c2 project); Volexity links the campaign to a suspected Pakistan-based actor tracked as UTA0137.