GoldFactoryThreat actor
GoldFactory is a threat actor group attributed to developing sophisticated mobile banking malware targeting victims primarily in the Asia-Pacific region, specifically Vietnam and Thailand. They utilize social engineering to deliver malware to victims' devices and have close connections to the Gigabud malware family.From MISP Galaxy
Last reported 1 month ago, by Check Point Research13 reports
ATT&CK techniques
6 of 20 · each with the sentence it comes from- T1684Social Engineering
“Passkey-themed campaign: Microsoft has spotted a pretty complex phishing and social engineering campaign hitting corporate environments using "fix your passkey" type of lures.”
- T1056.001Keylogging
“In this Trojan, AccessibilityService is leveraged for reading the User Interface (UI) and keylogging.”
- T1110.004Credential Stuffing
“Mastodon credential stuffing attack: Mastodon has been hit by a credential stuffing attack, looking for users who reuse their passwords across sites.”
- T1213.005Messaging Applications
“…iland’s environment, cybercriminals impersonate government authorities and convince victims to use LINE, one of the most popular messaging applications in the country.”
- T1657Financial Theft
“…e believe that they are a resourceful team involving numerous individuals in the processes of Trojan development, distribution, and financial theft.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
13 reports, newest first · the exact sentence from each-
14th September – Threat Intelligence Report“Researchers have analyzed an Android banking-fraud campaign by the GoldFactory group that abuses Android Work Profile functionality through a tool called Vwork to clone victims’ banking applications.”
-
Risky Bulletin: Anthropic agents went hacking again“Group-IB has linked Gigabug to a Chinese-speaking cybercrime group named GoldFactory.”
-
Gigabud Uses Android App Cloning to Evade Fraud Detection“It attributed both to GoldFactory, concluding the group had developed or customized each.”
-
Vwork: Weaponized Open-source Software as an Addon for Gigabud“Group-IB attributes Gigabud development to the GoldFactory group.”
-
One Adversary, Two Outcomes: The 0.027% Proof“The campaign, operated by a Chinese-speaking threat cluster tracked as GoldFactory, targeted taxpayers by impersonating the national tax platform: a service with 67 million registered users and, crucially, no official mobile app, so citizens had no reference point for spotting fa…”
-
RedHook Returns with a Dangerous Upgrade“RedHook’s distribution primarily occurs through social engineering, which are common techniques previously discussed in our GoldFactory blog on Android trojans.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“Trojan operators such as GoldFactory deploy mobile banking malware that even harvests facial recognition data for account access.”
-
Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia“Group-IB operational analysis reveals that the campaign is mainly orchestrated by the GoldFactory threat cluster, utilizing a shared infrastructure to deploy multiple malware families, including Gigabud.RAT and MMRat.”
-
Your Updated Guide to AI in Cybersecurity: Adoption, Trends, Challenges, and The Future“These techniques also extend beyond social engineering scams: groups like GoldFactory have demonstrated how stolen facial recognition data can be repurposed into AI-generated likenesses to bypass Know Your Customer (KYC) checks, open fraudulent accounts, or secure unauthorized lo…”
-
Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines“Hook for Gold: Inside GoldFactory’s Сampaign That Turns Apps Into Goldmines”
-
10 Cybersecurity Podcasts to Add to Your Queue Now“…de focuses on the Top 10 most prolific cyber gangs currently shaping the global threat landscape, including Lazarus, DragonForce, and GoldFactory.”
-
Under Siege: The threat of compromised Mobile Device Management credentials and its implications for organizational security“As we previously highlighted in our exposé of the GoldFactory iOS malware, this could enable them to peruse sensitive corporate data, implant malicious software, or assume remote control over the devices.”
-
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data“The whole threat cluster has been attributed by Group-IB to a single threat actor, codenamed GoldFactory that has developed a sophisticated suite of mobile banking malware.”
Indicators in its reports
named in the reports above- idscan[.]netin 1 report
- collusion[.]wikiin 1 report
- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.