GOLD CABINThreat actor
- atk236
- g0127
- monster libra
- shakthak
- Shathak
- ta551
GOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“In addition, lateral movement was enabled by leveraging Remote Desktop Protocol.”
- T1053.005Scheduled Task
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
- T1110Brute Force
“This fact is very important from the TTPs perspective: on rare occasions, the initial access is gained through a brute force attack against public-facing RDP-servers or just using valid accounts obtained from a third party.”
- T1110.003Password Spraying
“It’s important to note that the RaaS affiliates rarely perform brute force or password spraying attacks against such instances themselves, rather they buy accesses from the brokers.”
- T1133External Remote Services
“As already mentioned, many affiliates abuse external remote services, as well as exploit public-facing applications to obtain initial access to the target network.”
- T1484.001Group Policy Modification
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
What the reports say
1 report, newest first · the exact sentence from each-
REvil Twins: Ransomware-as-a-Service program“Commonly it uses capabilities of another threat actor – Shathak (which is also known for distributing Qakbot), and is distributed via weaponized Microsoft Word documents.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.