✕
Image
Currently viewing ATT&CK v19.2 which was live between April 28, 2026 and October 12, 2026. Learn more about the versioning system or see the live site.
ATT&CKcon 7.0 registration is open! Join us October 27-28, 2026 in McLean, VA or virtually. Register in person or register virtually. See the FAQ for hotel and venue details.
  1. Home
  2. Software
  3. GoBear

GoBear

GoBear is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. GoBear is exclusively linked to Kimsuky operations.[1][2]

ID: S1197
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 17 January 2025
Last Modified: 17 January 2025
Enterprise Layer
download view Image

Techniques Used

Domain ID Name Use
Enterprise T1036 .005 Masquerading: Match Legitimate Resource Name or Location

GoBear is installed through droppers masquerading as legitimate, signed software installers.[2]
Enterprise T1090 Proxy

GoBear implements SOCKS5 proxy functionality.[1]
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

GoBear uses stolen legitimate code signing certificates for defense evasion.[1][2]

Groups That Use This Software

ID Name References
G0094 Kimsuky

GoBear is exclusively linked to Kimsuky operations.[1][2]

References

  1. Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.
  1. Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.