Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor

The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia.
That's according to findings from cybersecurity firm ESET based on multiple Linux samples uploaded to the VirusTotal platform from Taiwan, the Philippines, and Singapore in March 2023.
WolfsBane has been assessed to be a Linux version of the threat actor's Gelsevirine backdoor, a Windows malware put to use as far back as 2014. Also discovered by the company is another previously undocumented implant named FireWood that's connected to another malware toolset known as Project Wood.
FireWood has been attributed to Gelsemium with low confidence, given the possibility that it could be shared by multiple China-linked hacking crews.
"The goal of the backdoors and tools discovered is cyber espionage targeting sensitive data such as system information, user credentials, and specific files and directories," ESET researcher Viktor Šperka said in a report shared with The Hacker News.

"These tools are designed to maintain persistent access and execute commands stealthily, enabling prolonged intelligence gathering while evading detection."
The exact initial access pathway used by the threat actors is not known, although it's suspected that the threat actors exploited an unknown web application vulnerability to drop web shells for persistent remote access, using it to deliver the WolfsBane backdoor by means of a dropper.
Besides using the modified open-source BEURK userland rootkit to conceal its activities on the Linux host, it's capable of executing commands received from an attacker-controlled server. In a similar vein, FireWood employs a kernel driver rootkit module called usbdev.ko to hide processes, and run various commands issued by the server.
The use of WolfsBane and FireWood is the first documented use of Linux malware by Gelsemium, signaling an expansion of the targeting focus.
"The trend of malware shifting towards Linux systems seems to be on the rise in the APT ecosystem," Šperka said. "From our perspective, this development can be attributed to several advancements in email and endpoint security."
"The ever-increasing adoption of EDR solutions, along with Microsoft's default strategy of disabling VBA macros, are leading to a scenario where adversaries are being forced to look for other potential avenues of attack."
Warning: Over 2,000 Palo Alto Networks Devices Hacked in Ongoing Attack Campaign
CISA says BianLian ransomware now focuses only on data theft
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability
CVE-2022-43769 Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability
CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability
CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability
InformationalNon-Storable Content
LowStrict-Transport-Security Malformed Content (Non-compliant with Spec)
InformationalRe-examine Cache-control Directives
InformationalCORS Header
MediumRelative Path Confusion
MediumParameter Tampering
Free online web security scanner