OMServerService.exe

OMServerService.exe is a Go-based backdoor masquerading as a legitimate file of the same name in Output Messenger environments. It was deployed by the Türkiye-linked cyberespionage actor Marbled Dust, also tracked as Sea Turtle, SILICON, UNC1326, Teal Kurma, and Cosmic Wolf, during exploitation of the Output Messenger directory traversal vulnerability CVE-2025-27920 affecting versions prior to 2.0.63 / version 2.0.62. In the reported campaign targeting users associated with the Kurdish military in Iraq, the actor likely obtained credentials via DNS hijacking or typosquatted domains, accessed the Output Messenger Server Manager as an authenticated user, and uploaded malicious files including OM.vbs, OMServerService.vbs, and OMServerService.exe. The malware was placed in the server Users/public/videos directory, while the VBS files were dropped into the startup folder to invoke the payload. OMServerService.exe performed connectivity checks to the hardcoded attacker-controlled domain api.wordinfos[.]com, sent victim or host identification information, and in some cases was observed using that domain for data exfiltration. The broader server compromise enabled theft of sensitive data, access to user communications, impersonation, and operational disruption. A related client-side backdoor, OMClientService.exe, was also used in the same campaign.