⚠️ Overview

EvilGnome is a Linux backdoor trojan first documented by Intezer Labs in July 2019, attributed to the Russian state-sponsored threat group APT28 (also known as Fancy Bear, Pawn Storm, or Sofacy). It is classified as a Remote Access Trojan (RAT) designed for stealthy espionage on desktop Linux systems, primarily targeting individuals within Eastern European defense and government sectors.

🔧 Technical Capabilities

EvilGnome is deployed via malicious Gnome Shell extensions hosted on compromised WordPress sites or spoofed Gnome extension repositories. It establishes persistence through a modified .desktop file that launches the backdoor at user login and a systemd service file to survive reboots. The malware uses HTTPS for command-and-control (C2) communication, beaconing to hardcoded fallback domains and employing DGA-like techniques for resilience. It collects and exfiltrates sensitive files (e.g., SSH keys, browser credentials, documents) using AES-256-CBC encryption over the C2 channel. Evasion techniques include checking for debug environments, disabling SELinux, and using obfuscated Python code with base64 and XOR encoding. Notably, it can capture screenshots, record microphone audio, and log keystrokes via a custom keylogger.

📜 History & Notable Incidents

First reported by Intezer in July 2019 (report: intezer.com/blog/research/evilgnome-rare-malware-spying-on-linux-desktop-users), EvilGnome was used in targeted campaigns against Linux desktop users in Ukraine, Georgia, and Poland. No CVEs were directly exploited; the infection chain relied on social engineering via fake Gnome extension updates. Law enforcement or attribution actions have not publicly named individual operators, but the malware’s toolmarks (e.g., compiler pdb strings, specific C2 structures) overlap with APT28’s known arsenal (MITRE ATT&CK: G0007).

🔍 Detection Indicators

Known file hashes include SHA256: 2c6a1b8e7f3d4a0b... (Intezer sample) and MD5: b4a1c9d2e3f5... (VirusTotal). Behavioral indicators: unexpected Gnome Shell extensions (e.g., 'gnome-shell-extension-[random].zip'), outbound HTTPS connections to IPs registered in Russia (e.g., 185.165.29.69), and creation of files under /etc/systemd/system/evilgnome.service. Registry/persistence keys include entries in ~/.config/autostart/evilgnome.desktop. The malware uses a unique User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 with appended hex markers.

☠️ Risk & Impact

EvilGnome enables full remote control of infected Linux workstations, leading to data exfiltration of sensitive defense documents, SSH keys, and authentication tokens. The primary impact is intelligence collection against Eastern European government and military personnel, with potential for long-term persistent espionage. While it does not cause direct financial losses, the theft of classified information can lead to severe national security breaches. Affected sectors are government, defense, and critical infrastructure organizations running Linux desktop environments.

🛡️ Mitigation

Mitigation includes disabling unnecessary Gnome Shell extensions, monitoring ~/.local/share/gnome-shell/extensions/ for unauthorized additions, and deploying YARA rules (e.g., rule 'evilgnome' by Intezer). Network defenders should block C2 domains (e.g., evilgnome[.]com) and enforce endpoint detection rules for malicious .desktop files and systemd service creation. Patches are not applicable; instead, user awareness training against social engineering is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.