GoMet Backdoor Used in Attacks Targeting Ukraine

What’s GoMet backdoor?

• The backdoor supports job scheduling using Cron or task scheduler based on the OS, file download, single command execution, and ability to open a shell or upload a file.
• GoMet features daisy-chain attack ability, whereby attackers gain access to a network or machine to gain access to multiple networks and computers for connections from one infected host to another, thus reaching hosts that are isolated from the internet.

Understanding the campaign

• Two samples of the backdoor with minor differences have been discovered, believed to have the same source code. 
• In the modified version, the cronjob was set up to run every two seconds instead of every hour. It prevents an hour-long sleep if a connection fails.
• If the malware failed to reach the C2, the backdoor sleeps for a random amount of time between five and ten minutes.
• To prevent forensic analysis, the backdoor enumerats autorun values. Instead of creating new values, it replaced one of the existing goodware autorun executables with the malicious one.

Ending notes