H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Gomir is a Linux backdoor variant of the Go-based malware [GoBear](https://attack.mitre.org/software/S1197), uniquely assoicated with [Kimsuky](https://attack.mitre.org/groups/G0094) operations.(Citation: Symantec Troll Stealer 2024)

Labels

malware

15 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Cron

Technique

uses

to Encrypted Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Internal Proxy

Technique

uses

to Local Groups

Technique

uses

to Remote System Discovery

Technique

uses

to Standard Encoding

Technique

uses

to Systemd Service

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Unix Shell

Technique

uses

to Web Protocols

Technique

uses

from Kimsuky

Group

2 external

References

mitre-attack

S1198

open

Symantec Troll Stealer 2024

https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage

open