Attackers target Ukraine using GoMet backdoor
Summary: Cisco Talos reported that a large Ukrainian software development company, whose software is used by state organizations in Ukraine, was targeted with a slightly modified version of the open-source GoMet backdoor, first observed on March 28, 2022, with samples hardcoded to the C2 IP 111.90.139[.]122. Talos assesses with moderate to high confidence that Russian state-sponsored actors or those acting in their interests are responsible, and noted the malware replaced an existing goodware autorun executable for persistence and ran its cron job every two seconds instead of the original hourly interval.
Why it matters: The target was a software firm whose products reach Ukrainian state organizations, and Talos could not rule out that the intent was source access for a supply chain-style attack - a reminder that a compromised build pipeline can carry an intrusion into every downstream customer.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2020-5902CVE-2022-1040
- Related
- Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report Cyber Risks ·At The Edge Clear: March 2 – 9, 2026 Cyber Risks ·