After obtaining initial network access through a supply chain attack or breached contractors, ExCobalt proceeded to leverage Mimikatz, Spark RAT, SMBExec, Metasploit, and ProcDump, as well as several Linux privilege escalation vulnerabilities to facilitate the deployment of the Golang-based GoRed malware without being detected by anti-malware systems, a report from Positive Technologies revealed. Aside from enabling command execution and credential theft, GoRed also allows process, network interface, and file system data exfiltration, command-and-control communications, and reverse shell activation, reported researchers.

Source: SC Magazine