Gelsemium: The Quiet China-Aligned Group That Moved to Linux

Gelsemium (MITRE ATT&CK G0141) is a China-aligned APT active since at least 2014, named by ESET after its flagship Windows backdoor Gelsevirine. It keeps a quiet public profile. In November 2024 ESET disclosed the group’s first known Linux malware — the WolfsBane and FireWood backdoors — marking a shift toward Linux targeting. ESET attributes WolfsBane to Gelsemium with high confidence but FireWood only with low confidence, noting FireWood may be shared across multiple China-aligned groups.

Attribution

Gelsemium is assessed as a China-aligned espionage actor; attribution rests chiefly on ESET’s technical analysis rather than a government statement. The WolfsBane–Gelsemium link is high confidence; the FireWood link is low confidence and should be treated as tentative.

Targeting

Governments, electronics and hardware manufacturers, universities and religious organisations, primarily in East Asia and the Middle East. VirusTotal samples of the Linux tooling were uploaded from Taiwan, the Philippines and Singapore — an upload location is a weak indicator and not a confirmed victim location.

Notable Activity

• 2021: ESET documented the group’s Windows espionage activity and assessed a likely link to the NoxPlayer supply-chain incident.
• November 2024: ESET disclosed WolfsBane and FireWood — Gelsemium’s first known Linux backdoors (underlying samples date to roughly March 2023). No clearly dated 2025–2026 campaign has surfaced publicly, so current activity level is uncertain.

Malware & Tooling

The Windows chain is Gelsemine (dropper) → Gelsenicine (loader) → Gelsevirine (modular backdoor that loads plug-ins from its C2). On Linux, WolfsBane is the Gelsevirine counterpart (dropper → launcher → backdoor, with a modified open-source userland rootkit), and FireWood ties to the older “Project Wood” backdoor, integrating kernel modules for process hiding and TEA-encrypted C2. China Chopper web shells feature in historical activity.

MITRE ATT&CK Mapping

Detection & Mitigation

• Extend EDR and telemetry to Linux servers, not just Windows; hunt for userland rootkit artefacts, unexpected shared-library preloading and process-hiding kernel modules.
• Patch and monitor internet-facing Exchange and web applications — the historical and suspected initial-access vector — and hunt for China Chopper-style web shells.
• Detect the multi-stage dropper→loader→backdoor pattern and anomalous encrypted C2 egress from servers.