ProjectWood

Project Wood is a sophisticated backdoor malware that has been evolving since 2005, associated with the Gelsemium APT group. It uses TEA encryption algorithm with variable rounds for C&C communication, employs kernel driver modules for process hiding, and implements multiple persistence mechanisms. The malware is known for its Linux variant FireWood and has been used in various operations including Operation TooHash.