ExCobalt Cyber Gang Targets Russian Sectors with New GoRed Backdoor

Researchers at Positive Technologies attribute active cyber espionage operations against Russian government, IT, industrial, and telecom sectors to ExCobalt (likely evolved from the Cobalt Gang). The group uses supply-chain and compromised-contractor access, a custom Golang backdoor named GoRed (with RPC C2 and credential/process/file harvesting), common post-exploitation tools and multiple Linux privilege-escalation exploits to steal data and maintain access.