Loading malware…
goddi is an open-source Active Directory information dumping tool, described as "Go dump domain info." In the provided reporting, it was used by the China-linked cyber-espionage group Bronze Butler (also known as Tick/BRONZE BUTLER) during a mid-2025 campaign that exploited CVE-2025-61932 in Motex LANSCOPE Endpoint Manager. Sophos/CTU observed the tool being used post-compromise for Active Directory information dumping as part of broader intrusion activity aimed at stealing confidential information. In the same operations, the actors also used Gokcpdoor or Havoc for command-and-control, OAED Loader for payload injection into legitimate executables, remote desktop through backdoor tunnels for remote access, and 7-Zip plus cloud storage services for exfiltration. No goddi-specific indicators of compromise were provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sophos also reports that Bronze Butler used the goddi Active Directory dumper...
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory dumping tool used to extract directory data/credentials during the intrusion.
goddi is an open-source tool used to dump Active Directory information, leveraged by BRONZE BUTLER for lateral movement and information gathering.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.