Chinese hackers target Linux with new WolfsBane malware

ESET researchers uncovered WolfsBane, a Linux backdoor attributed to the Gelsemium APT that uses a dropper, launcher, encrypted libraries and a modified BEURK userland rootkit for stealth and persistence, and FireWood, a related Linux backdoor potentially leveraging a kernel rootkit; both provide extensive C2-driven command execution, data exfiltration and long-term espionage capabilities, with IOCs published on GitHub.