Threat intelligence / Malware

BOLDMOVE

[BOLDMOVE](https://attack.mitre.org/software/S1184) is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. [BOLDMOVE](https://attack.mitre.org/software/S1184) includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. [BOLDMOVE](https://attack.mitre.org/software/S1184) is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs.(Citation: Google Cloud BOLDMOVE 2023) The record for [BOLDMOVE](https://attack.mitre.org/software/S1184) only covers known Linux variants.

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BOLDMOVE](https://attack.mitre.org/software/S1184) is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. [BOLDMOVE](https://attack.mitre.org/software/S1184) includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. [BOLDMOVE](https://attack.mitre.org/software/S1184) is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs.(Citation: Google Cloud BOLDMOVE 2023) The record for [BOLDMOVE](https://attack.mitre.org/software/S1184) only covers known Linux variants.

Labels

malware

14 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Create or Modify System Process

Technique

uses

to Disable or Modify Tools

Technique

uses

to Execution Guardrails

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ignore Process Interrupts

Technique

uses

to Multi-hop Proxy

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S1184

Google Cloud BOLDMOVE 2023

https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/