S1184 BOLDMOVE

malwareEnterprise

platformsLinux · Network Devices

also known asBOLDMOVE

BOLDMOVE is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. BOLDMOVE includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. BOLDMOVE is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs. The record for BOLDMOVE only covers known Linux variants.

techniques used (14)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1059.004Unix Shell
T1070.004File Deletion
T1071.001Web Protocols
T1082System Information Discovery
T1083File and Directory Discovery
T1090.003Multi-hop Proxy
T1190Exploit Public-Facing Application
T1480Execution Guardrails
T1543Create or Modify System Process
T1554Compromise Host Software Binary
T1564.011Ignore Process Interrupts
T1573.002Asymmetric Cryptography
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan