GoBear

MITRE

Malware Type:
Other

First seen:
Unknown

Last seen:
Unknown

Details:

[GoBear](https://attack.mitre.org/software/S1197) is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. [GoBear](https://attack.mitre.org/software/S1197) is exclusively linked to [Kimsuky](https://attack.mitre.org/groups/G0094) operations.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)

Associated Techniques (3)

ID	ATT&CK	Tactics
T1036.005	Match Legitimate Resource Name or Location	-
T1090	Proxy	-
T1553.002	Code Signing	-

Used by Actors (1)

Kimsuky
Nation-state

Metadata

ID:	435
Created:	13/01/2026 17:48
Updated:	21/04/2026 16:00