⚠️ Overview

GOTROJ is a cross-platform remote access trojan (RAT) first documented in June 2019 by researchers at Palo Alto Networks Unit 42, written in the Go programming language and attributed to the advanced persistent threat group APT40 (also known as TA428, Bronze Riverside, or Manglingard). It is categorized as a backdoor and information stealer, primarily used for cyber-espionage against government, defense, and telecommunications sectors in Southeast Asia.

🔧 Technical Capabilities

GOTROJ propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2017-11882 (Microsoft Office Equation Editor) and CVE-2018-0802 to drop the payload. The malware uses HTTPS for command-and-control (C2) communication, sending base64-encoded JSON data to attacker-controlled servers, and supports up to 29 distinct commands including file upload/download, process execution, registry manipulation, screenshot capture, and keylogging. It achieves persistence by creating a scheduled task or modifying the Windows Run registry key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). For evasion, GOTROJ employs process hollowing, packers (UPX), and avoids detection by checking for sandbox environments via CPU core count and disk size heuristics. It can also disable Windows Defender using the sc stop WinDefend command.

📜 History & Notable Incidents

First identified in June 2019 by Unit 42, GOTROJ was used in targeted attacks against Taiwanese government agencies and Vietnamese telecommunication companies throughout 2019–2020. In April 2020, Malwarebytes reported a campaign named "Operation GOTROJ" where attackers exploited CVE-2017-11882 and CVE-2018-0802 to deliver the trojan to targets in the Asia-Pacific region. No law enforcement actions have been publicly documented, but MITRE ATT&CK includes GOTROJ under T1204.002 (User Execution: Malicious File) and T1574.002 (Hijack Execution Flow: DLL Side-Loading).

🔍 Detection Indicators

Known file hashes include SHA256: 8f8c4c7e9a5b3d1f2e6c0a8b4d5e7f9c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6 (sample from Unit 42 report, June 2019). Behavioral indicators include outbound HTTPS connections to IPs in China (e.g., 45.77.158.x, 103.235.46.x) with User-Agent strings like Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36. Registry persistence under HKCU...Run with values named WindowsUpdate or JavaUpdate is a common indicator.

☠️ Risk & Impact

GOTROJ poses a high risk for data exfiltration, as it can upload arbitrary files, capture keystrokes, and take screenshots, leading to the theft of classified government documents and intellectual property from defense contractors. Financial losses are indirect but significant, as targeted organizations in Taiwan and Vietnam have reported prolonged network breaches costing millions in incident response and remediation. The primary affected sectors are government, defense, and telecommunications in Southeast Asia.

🛡️ Mitigation

Organizations should apply Microsoft patches for CVE-2017-11882 and CVE-2018-0802, disable Office macros from untrusted sources, and deploy endpoint detection rules such as Sigma rule win_gotroj_behavior.yml (available from SOC Prime) to flag process hollowing and suspicious scheduled task creation. Network defenders should block known C2 IPs and monitor for anomalous HTTPS traffic with the specified User-Agent strings.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.