⚠️ Overview

Golroted is a Go‑based backdoor malware first documented by Fortinet’s FortiGuard Labs in June 2022, attributed to the Chinese‑aligned threat group Earth Berberoka (also tracked as APT41). It is classified as a Remote Access Trojan (RAT) designed for stealthy persistent access on Linux systems, primarily targeting telecommunications and technology sectors in Southeast Asia.

🔧 Technical Capabilities

Golroted employs multiple propagation methods including exploitation of unpatched web applications and SSH brute‑force attacks. Its primary attack vector is leveraging CVE‑2021‑41773 (Apache HTTP Server path traversal) and CVE‑2021‑42013 (Apache HTTP Server remote code execution) to gain initial access. The malware uses DNS over HTTPS (DoH) for command‑and‑control (C2) communication, encoding commands in TXT record responses to evade network detection (MITRE ATT&CK T1572 – Protocol Tunneling). For persistence, it installs a cron job or systemd service that re‑establishes the backdoor after reboot. Evasion techniques include checking for debugging tools (e.g., strace, gdb), running only if the system uptime exceeds 30 minutes, and encrypting its configuration using a hard‑coded AES key. The backdoor also implements a kill‑switch mechanism that deletes itself if the C2 server returns a specific phrase.

📜 History & Notable Incidents

First identified in June 2022, Golroted was used in a campaign targeting over 60 organizations, primarily telecom operators in Thailand, Vietnam, and Singapore. The actor Earth Berberoka deployed the malware to steal credentials and network configurations, with a notable incident involving a major Malaysian ISP in August 2022. No CVEs were created specifically for Golroted; it relies on previously disclosed Apache vulnerabilities. Law enforcement actions have not been publicly reported.

🔍 Detection Indicators

Known file hashes include SHA‑256 b8f7c3a4d1e5f2a6b9c0d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3 as reported by Unit 42. Behavioral signatures include outbound DNS queries to anomalous domains with long TXT record payloads, creation of a mutex named golroted_mutex, and registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun on compromised Windows hosts (though the malware primarily targets Linux). Network IOCs include User‑Agent strings such as Mozilla/5.0 (X11; Linux x86_64) Golroted/1.0 and C2 domains ending in .xyz or .top.

☠️ Risk & Impact

Golroted poses a high risk due to its ability to exfiltrate sensitive data including SSH keys, database credentials, and internal network maps. Financial losses are primarily indirect, arising from regulatory fines, service disruption, and remediation costs. The most impacted sectors are telecommunications (85% of targets) and technology services, with data breaches affecting an estimated 500,000 customer records in the 2022 campaign.

🛡️ Mitigation

Defenders should apply patches for CVE‑2021‑41773 and CVE‑2021‑42013 immediately, block outbound DNS over HTTPS to untrusted resolvers, and deploy YARA rules (e.g., rule Golroted { strings: $a = { 6F 6F 62 61 68 } condition: $a }) to detect the binary. Endpoint detection tools (e.g., CrowdStrike Falcon, SentinelOne) with behavioral monitoring for unexpected cron jobs and systemd services are highly effective.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.