DISGOMOJI Malware Used to Target Indian Government
Summary: Volexity identified a 2024 cyber-espionage campaign by a suspected Pakistan-based threat actor it tracks as UTA0137, using Golang Linux malware it calls DISGOMOJI against Indian government entities. DISGOMOJI is a fork of the open-source discord-c2 project that uses Discord channels and emoji-based commands for command and control, and Volexity also found UTA0137 using the DirtyPipe (CVE-2022-0847) exploit against BOSS 9 systems that remain vulnerable.
What's compelling: The target is India's government desktop, a custom Linux distribution called BOSS, and Volexity assesses the campaigns appear to have been successful - with DirtyPipe, a 2022 vulnerability, still granting root on BOSS 9.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-0847
- Related
- CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 25, 2022University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026