Gamaredon_Group__2019__EvilGnome_Rare_Malware_Spying_on_Desktop_Users.pdf

This technical analysis documents EvilGnome, a previously unseen Linux backdoor masquerading as a GNOME extension that captures screenshots, records microphone audio, scans and exfiltrates files, and supports downloading additional modules; the report covers its makeself-based deployment, cron persistence, RC5-encrypted C2 communications, module internals, identified IOCs (file hashes and IPs), and presents infrastructure evidence linking it to the Gamaredon threat actor.