GoBear — Malware Profile

GoBear is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. GoBear is exclusively linked to Kimsuky operations.

MITRE ATT&CK techniques (3)

• T1036.005 Match Legitimate Resource Name or Location
• T1090 Proxy
• T1553.002 Code Signing

Attributed threat actors

• Kimsuky

Read the full analysis on IntelFusions