GoldDiggerMalware
Last reported 4 months ago, by Sekoia.io4 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1056.001Keylogging
“This means it can see the victim’s balance, harvest the second credential issued for two-factor authentication, and implement keylogging functions, allowing it to capture credentials.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1036Masquerading
“GoldDigger spreads via fake websites masquerading as Google Play pages and fake corporate websites in Vietnam.”
- T1110Brute Force
“The checkm8 vulnerability is especially relevant today because it is being exploited by many various vendors, who use it to brute-force passcodes on iOS devices.”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1213.005Messaging Applications
“…iland’s environment, cybercriminals impersonate government authorities and convince victims to use LINE, one of the most popular messaging applications in the country.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“GoldFactory develops and deploys a range of highly sophisticated banking Trojans, including GoldPickaxe, GoldKefu, GoldDigger, and GoldDiggerPlus.”
-
GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself“GoldPickaxe, the first iOS Trojan that harvests facial recognition data, is a modified version of the Android Trojan GoldDigger — but with new capabilities.”
-
Face Off: Group-IB identifies first iOS trojan stealing facial recognition data“The GoldDigger family grows”
-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix”
Indicators in its reports
named in the reports above- ks8cb[.]ccin 2 reports
- ms2ve[.]ccin 2 reports
- zu7kt[.]ccin 2 reports
- d8834a21bc70fbe2…e35be1b7276bin 2 reports
- hds6y[.]ccin 2 reports
- smgeo[.]ccin 2 reports
- www.dg1e[.]comin 2 reports
- wbke[.]ccin 2 reports
- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- gname[.]comin 1 report
- hxxps://raw.githubusercontent[.]com/nvm-sh/nvm/v0.39.7/install.shin 1 report
- hxxps://testflight.apple[.]com/join/in 1 report
- 18.143.229[.]200in 1 report
- bweri6[.]ccin 1 report
- blsdk5[.]ccin 1 report
- nnzf1[.]ccin 1 report
- t8bc[.]xyzin 1 report
- app.js6kk[.]xyzin 1 report
- bv8k[.]xyzin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.