Loading malware…
Golden Chickens is a malware-as-a-service ecosystem operated by the threat actor commonly tracked as Venom Spider and associated with the underground persona badbullzvenom. Active since at least 2018, it provides a modular toolkit to financially motivated intrusion sets including FIN6, Cobalt Group, and Evilnum. The platform is centered on the more_eggs backdoor and loader and has evolved into a broader family of interchangeable implants and plugins designed for targeted enterprise intrusions.
Golden Chickens tooling is primarily associated with Windows environments and commonly uses social-engineering lures for initial compromise, especially job-themed campaigns delivered through fake resumes, fake job offers, and malicious shortcut files. Observed campaigns have also used bank-document-themed lures and targeted corporate employees, hiring managers, and organizations in sectors including financial services, retail, chemical, and e-commerce.
The ecosystem is notable for its modular architecture. Documented components include VenomLNK for user execution and initial access, TerraLoader for loading follow-on plugins, TerraRecon for host and network profiling, TerraStealer for theft of credentials and email data from browsers, email clients, and transfer utilities, TerraLogger for keystroke capture, TerraTV for hijacking active TeamViewer sessions to facilitate lateral movement, TerraPreter for interactive post-exploitation activity including discovery and credential theft, and TerraCrypt as an encryption payload intended for ransomware-style extortion. More recent families linked to the ecosystem include TinyEgg, a lightweight backdoor used for initial access and host profiling; ChonkyChicken, a more capable implant supporting browser credential theft and live browser session control; a modularized ChonkyChicken variant with on-demand plugin loading; and ChromEggscalator, a Chrome encryption-bypass utility.
Golden Chickens emphasizes selective capability deployment, shared command-and-control patterns, persistence mechanisms, and obfuscation across families. This operator-driven modularity supports defense evasion, reduces exposure of the full toolset during individual intrusions, and increases the commercial flexibility of the service for different criminal customers.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
For the past 16 months, eSentire’s security research team, the Threat Response Unit (TRU) has been tracking one of the most capable and stealthy malware suites — Golden Chickens.
For the past 16 months, eSentire’s security research team, the Threat Response Unit (TRU) has been tracking one of the most capable and stealthy malware suites — Golden Chickens.
For the past 16 months, eSentire’s security research team, the Threat Response Unit (TRU) has been tracking one of the most capable and stealthy malware suites — Golden Chickens.
The Hacker News disclosed that the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
The Cobalt Group's typical MO was to infiltrate banking institutions by sending spear phishing emails with malicious attachments to bank employees.
The Evilnum group is also known to spear phish employees of the companies they are targeting and enclose malicious zip files. If executed, the employees often get hit with the more_eggs backdoor, along with other malware.
The operators then send a link leading to a mock resume PDF through the organization‘s recruitment platform (e.g. Indeed, LinkedIn, or the organization‘s own career web page). The PDF purports to be broken, offering an embedded link to the malicious VenomLNK file on the branding website.
For example, PowerShell is removed from the attack chain to reduce detection...
They have also taken great pains to obfuscate the Golden Chickens malware, trying to make it undetectable by most AV companies...
Employ exhaustive endpoint monitoring for LOLBINs, aka Trusted Windows Binary abuse. LOLBINs of interest include cmd.exe, wscript.exe, wmic.exe, cmstp.exe, msxsl.exe, powershell.exe, and ie4uinit.exe.
Using a CAPTCHA on a website makes it harder for security researchers and their tools, especially if those tools are automated, to retrieve and analyze if there is any malware present.
Using a CAPTCHA on a website makes it harder for security researchers and their tools, especially if those tools are automated, to retrieve and analyze if there is any malware present.
69 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.