GOFFEEThreat actor
GOFFEE is a threat actor that has targeted entities in the Russian Federation since early 2022, employing spear phishing emails with malicious attachments, including modified Owowa and patched explorer.exe.From MISP Galaxy
Last reported 2 months ago, by AhnLab ASEC1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1221Template Injection
“Viceroy Tiger (Donot) targeted Bangladeshi military and defense officials using remote template injection and a multi-stage shellcode loader.”
- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
July 2026 Threat Trend Report on APT Groups“CloudAtlas employed remote template injection and maintained a Google Sheets-based C2, while GOFFEE utilized legitimate utilities and the Mythic agent to conduct reconnaissance, access credentials, and carry out follow-up activities in container environments.”
Thanks — we review every report.