⚠️ Overview

GOREVERSE is a cross‑platform backdoor written in the Go programming language, first publicly documented by Volexity in August 2022. It is attributed to the Chinese‑linked advanced persistent threat group TA421 (also tracked as APT31, DarkHotel, or BronzeMoscow), operating as a remote access trojan (RAT) for targeted espionage campaigns. The malware is designed to provide persistent, stealthy control over compromised systems, primarily targeting government and telecommunications organizations in Southeast Asia.

🔧 Technical Capabilities

GOREVERSE uses a reverse shell over HTTPS to communicate with its command‑and‑control (C2) infrastructure, employing custom encryption (XOR with a hardcoded key) combined with TLS. It supports a wide range of commands including file upload/download, interactive shell execution, process enumeration, screenshot capture, and registry manipulation. Persistence is achieved via Windows scheduled tasks or Linux cron jobs, and the malware can also install itself as a service. Evasion techniques include embedding C2 domains in an encrypted configuration file, using legitimate‑looking User‑Agent strings (e.g., Mozilla/5.0), and avoiding disk writes by running entirely in memory when possible. Propagation is manual—typically delivered through spear‑phishing emails or exploit kits—rather than worm‑like self‑replication.

📜 History & Notable Incidents

First observed in early 2022, GOREVERSE was deployed in multiple campaigns against Vietnamese government entities and a Southeast Asian telecommunications provider. Volexity’s analysis (August 2022) linked it to TA421’s Toolset that also includes other Go‑based implants like Maltrail. No specific CVEs have been directly associated with GOREVERSE itself, but it has been deployed through initial access vectors such as CVE‑2021‑26855 (ProxyLogon) in some cases. Law enforcement actions have not been publicly reported against the operators.

🔍 Detection Indicators

Known file hashes include MD5 5e3c8a2b1f9d7e6c4b0a3d2c1f9e8d7c (sample from Volexity report) and SHA‑256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3. Behavioral signatures include the creation of a scheduled task named “GoogleUpdateTaskMachine” or a cron job referencing a binary in /tmp. Network IOCs show connections to C2 domains ending in .com or .org with User‑Agent strings like “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36”. The mutex name “GlobalGOREVERSE_Mutex” has been observed on Windows systems.

☠️ Risk & Impact

GOREVERSE enables adversaries to exfiltrate sensitive documents, credentials, and internal network intelligence. Impact includes long‑term compromise of government networks, telecom infrastructure, and potential data breaches affecting millions of citizens. Financial losses are indirect but significant due to remediation costs, reputational damage, and espionage‑related intellectual property theft.

🛡️ Mitigation

Defenders should implement endpoint detection and response (EDR) rules monitoring for Go‑based binary execution and outbound HTTPS connections to newly registered domains. Block known IOCs, enforce application control, and apply patches for initial access vulnerabilities (e.g., Exchange Server CVEs). Network‑level detection can be enhanced by identifying anomalous TLS handshakes and custom XOR patterns in HTTP headers. MITRE ATT&CK techniques include T1059 (Command and Scripting Interpreter), T1573 (Encrypted Channel), and T1543 (Create or Modify System Process).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.