Researchers Detail Goffee’s Malware and Stealthy Attacks on Russian Organizations
Summary
Positive Technologies researchers analyzed Goffee attacks on Russian organizations, detailing new malware and tools, including the Sauropsida Linux rootkit, and the group’s phishing, tunneling, evasion, and infrastructure techniques.
Key points
- Goffee has targeted Russian organizations with phishing since 2022; investigators linked incidents from 2024 onward to the group.
- Newly identified tools include the Sauropsida Linux rootkit, DQuic QUIC tunnel, BindSycler SSH tunnel, and MiRat Mythic agent.
- The group used PowerTaskel, Sliver, modified owowa modules, and Nim-based Infinity Loader droppers across Windows and Linux systems.
- Sauropsida can hide processes, files, connections, and its kernel module, and provides reverse- or bind-shell access.
- Goffee used compromised accounts and exploited PolKit CVE-2021-4034 for Linux privilege escalation; 2025 phishing archives also exploited a WinRAR path-traversal flaw affecting versions up to 7.12.
- The attackers use tunneling and obfuscation to maintain stealth, and commonly host infrastructure on Russian IP addresses and providers.
- Researchers say repeated malware-packing, encryption, and infrastructure traits can help attribute incidents and anticipate the group’s activity.
Article Details
- Attack Vectors
- Phishing emails targeting Russian organizations, including emails with malicious archives and documents impersonating Russia's Ministry of Industry and Trade.
- Exploitation of CVE-2025-6218 to place malware in the Windows startup folder, and exploitation of a WinRAR path-traversal vulnerability affecting versions up to and including 7.12.
- Exploitation of CVE-2021-4034 for privilege escalation on Linux.
- Malware delivery through compromised accounts and vulnerable nodes, followed by deployment of loaders, shellcode, and tunneling tools.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | impact-dns[.]ru | Domain found on the IP address reported as the sender of a Goffee phishing email. |
| DOMAIN | rt-inforu[.]ru | Domain found on the IP address reported as the sender of a Goffee phishing email. |
| IPV4 | 109[.]107[.]189[.]187 | Address contacted by the compromised host to receive a file over a TCP connection. |
| IPV4 | 194[.]180[.]191[.]190 | Remote address involved in a connection from a compromised host that sent a system service file. |
| IPV4 | 213[.]171[.]4[.]200 | Russian IP address reported as the sender of a phishing email in a Goffee attack. |
| IPV4 | 89[.]110[.]88[.]155 | Russian-zone IP address used by malware in the July 2025 attack. |
| IPV4 | 89[.]110[.]98[.]26 | Russian IP address hosting a domain used in the later July 2025 attacks. |
| IPV4 | 94[.]242[.]51[.]73 | Russian IP address hosting a domain used in the later July 2025 attacks. |
| URL | hxxps[:]//eliteheirs[.]org/checks/brandished/dyestuffs/abbess/interrelation | Malicious attack-chain URL used in the July 2025 phishing attack. |
MITRE ATT&CK
T1014 · RootkitThe Sauropsida rootkit hid the attackers' presence, including processes, files, and network connections.T1027 · Obfuscated Files or InformationThe group used Ebowla, garble, and custom encryption or obfuscation methods to hinder analysis of payloads and strings.T1055 · Process InjectionPowerTaskel injected downloaded shellcode into the current process thread; MiRat also supports running received shellcode in a thread within its process.T1059.001 · PowerShellThe loader launched hidden PowerShell to monitor trigger.txt, decode its contents, and execute them.T1059.003 · Windows Command ShellMiRat can execute server-supplied commands through cmd.exe.T1059.004 · Unix ShellThe attackers used a bash interpreter on a compromised Linux system, and Sauropsida's reverse shell can execute received commands via bash.T1068 · Exploitation for Privilege EscalationThe attackers exploited CVE-2021-4034 for privilege escalation on Linux.T1105 · Ingress Tool TransferAfter gaining access, the attackers uploaded tools to infected hosts and downloaded additional files and payloads.T1203 · Exploitation for Client ExecutionA WinRAR vulnerability was exploited through crafted archives to extract malicious files.T1205.001 · Port KnockingSauropsida used UDP port-knocking packets with specific prefixes to receive encrypted shell configuration.T1547.001 · Registry Run Keys / Startup FolderA crafted archive exploited WinRAR to place a malicious executable and shortcut in the Windows Startup folder.T1566.001 · Spearphishing AttachmentGoffee phishing emails delivered malicious archives and attachments, including lures impersonating Russia's Ministry of Industry and Trade.T1572 · Protocol TunnelingDQuic tunneled traffic over QUIC, while BindSycler established traffic tunnels over SSH.T1574.002 · DLL Side-LoadingThe Windows Mythic MiRat agent was launched through DLL sideloading using wsmprovhost.exe and related DLLs.T1620 · Reflective Code LoadingThe loader reflectively loaded a received .NET module into the system.
CVE
People
Threat Actors
Malware
Infinity LoaderIt was delivered inside the Infinity Loader dropper, written in Nim.MiRatWindows 1cv8conn.exe Chisel server packaged with Ebowla MiRat Mythic agent NoOWOWAThe attackers used known tools such as Powertaskel and owowa. We also identified new tools: the BindSycler and DQuic traffic tunneling tools and a new Mythic agent.Sauropsidaorganizations through phishing since 2022. In one case, we observed a previously unknown Linux rootkit, Sauropsida.SliverLinux systemd-resolved TinyShell in server mode Sliver Nim dropper Yes
Products
Tools
BindSyclerThe attackers used known tools such as Powertaskel and owowa. We also identified new tools: the BindSycler and DQuic traffic tunneling tools and a new Mythic agent.ChiselWindows 1cv8conn.exe Chisel server packaged with Ebowla MiRat Mythic agent NoDQuicThe attackers used known tools such as Powertaskel and owowa. We also identified new tools: the BindSycler and DQuic traffic tunneling tools and a new Mythic agent.EbowlaTo hinder analysis, the attackers use the Ebowla packer, the garbler obfuscator for Golang, and a proprietary algorithm to encrypt network traffic and malicious payloads.Garblevia the SSH protocol. Depending on settings, it can operate over TCP or UDP. The tool is obfuscated with garble, so some function names are missing and most libraries and types are renamed.GophishThe GoPhish tool is used to send phishing emails.Impacket(CVE 2021 4034). They also used known tools: RawCopy (for low level reads from NTFS disks), Impacket, and Veeam Extract (to inspect backups).Metasploit Frameworkmalware in the startup folder. The malware itself was a patched XPS document loader, xpsrchvw.exe, with Metasploit inside. The malicious shellcode establishes a connection and opens a reverse shell.MythicThe attackers used known tools such as Powertaskel and owowa. We also identified new tools: the BindSycler and DQuic traffic tunneling tools and a new Mythic agent.PowerTaskelThe attackers used known tools such as Powertaskel and owowa. We also identified new tools: the BindSycler and DQuic traffic tunneling tools and a new Mythic agent.RawCopyon Linux, the attackers exploited the PolKit vulnerability (CVE 2021 4034). They also used known tools: RawCopy (for low level reads from NTFS disks), Impacket, and Veeam Extract (to inspect backups).TinyShellLinux systemd-resolved TinyShell in server mode Sliver Nim dropper YesVeeam Extract2021 4034). They also used known tools: RawCopy (for low level reads from NTFS disks), Impacket, and Veeam Extract (to inspect backups).