Kimsuky hackers deploy new Linux backdoor in attacks on South Korea

Symantec and S2W researchers report that North Korean APT Kimsuky used trojanized software installers in a supply-chain campaign against South Korean targets to deliver a new Linux backdoor named Gomir (a Linux variant of the GoBear backdoor) alongside Troll Stealer; Gomir implements persistence (copies to /var/log/syslogd, creates a systemd 'syslogd' service, and attempts crontab), communicates with C2 via HTTP POST, supports 17 remote operations including command execution, reverse proxying, and file exfiltration, and the researchers published indicators of compromise and analysis linking the activity to Kimsuky.