MITRE ATT&CKsoftware (malware)
S1184 BOLDMOVE
- Domain
- enterprise
- Platforms
- Linux, Network Devices
- Version
- 1.0
- Created
- 2024-12-31
Description
BOLDMOVE is a type of backdoor malware written in C linked to People’s Republic of China operations from 2022 through 2023. BOLDMOVE includes both Windows and Linux variants, with some Linux variants specifically designed for FortiGate Firewall devices. BOLDMOVE is linked to zero-day exploitation of CVE-2022-42475 in FortiOSS SSL-VPNs. The record for BOLDMOVE only covers known Linux variants.
Related
Uses · MITRE ATT&CK (14)
- T1685 Disable or Modify Tools technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1059.004 Unix Shell sub-technique
- T1554 Compromise Host Software Binary technique
- T1070.004 File Deletion sub-technique
- T1543 Create or Modify System Process technique
- T1480 Execution Guardrails technique
- T1190 Exploit Public-Facing Application technique
- T1016 System Network Configuration Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
References
- https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/ Google Cloud BOLDMOVE 2023