Gomir
- ID
- S1198
- Type
- Malware
- Platforms
- Linux
- Source
- attack.mitre.org
- MITRE last modified
- 18 Jan 2025
Gomir is a Linux backdoor variant of the Go-based malware GoBear, uniquely assoicated with Kimsuky operations.[1]
Techniques used (14)
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1053.003 Cron
- T1059.004 Unix Shell
- T1069.001 Local Groups
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090.001 Internal Proxy
- T1132.001 Standard Encoding
- T1543.002 Systemd Service
- T1573 Encrypted Channel
- T1573.002 Asymmetric Cryptography