21.Globe RadiatingCode

The usage of Blueshell malware spikes up by various threat actors to target Windows, Linux, and other operating systems across Korea and Thailand.

Blueshell backdoor malware has been active since 2020 and written in GO language, believed to be created by a Chinese user, which is available on the GitHub repository. 

Though the original GitHub repository was deleted, BlueShell’s source code can still be accessed from other repositories. 

AhnLab Security Emergency Response Center (ASEC) monitors APT attack cases using BlueShell and has released the summarized report of APT attack cases using BlueShell.

Considering the functionality of the Backshell, it is designed and uses TLS encryption to circumvent network detection with the C&C server. 

The Remote command execution, file download/upload, and Socks5 proxy were executed by the attacker through commands.