Malware: GoBear

Description

[GoBear](https://attack.mitre.org/software/S1197) is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. [GoBear](https://attack.mitre.org/software/S1197) is exclusively linked to [Kimsuky](https://attack.mitre.org/groups/G0094) operations.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)

External References

• mitre-attack
• S2W Troll Stealer 2024
• Symantec Troll Stealer 2024

Techniques Used by This Malware

• T1036.005 — Match Legitimate Resource Name or Location
• T1090 — Proxy
• T1553.002 — Code Signing

APT Groups Using This Malware

• Kimsuky