FireWood

FireWood is a Linux-based backdoor malware associated with the Chinese advanced persistent threat (APT) group Gelsemium. It serves as a successor to the Windows-based Project Wood backdoor, enabling attackers to maintain persistent access to compromised Linux systems. FireWood incorporates a kernel-level rootkit, specifically the 'usbdev.ko' module, to conceal its malicious activities by hiding processes and files. Its primary functions include executing commands from a command-and-control (C2) server, exfiltrating sensitive data, and facilitating cyber-espionage operations.