GOLDTOMB
GOLDTOMB is a FIN11-associated backdoor referenced in reporting on 2025 Oracle E-Business Suite (EBS) exploitation and extortion activity. The analyzed Oracle EBS campaign reused CL0P contact emails and showed technical links to GOLDVEIN.JAVA and GOLDTOMB malware previously used by FIN11/UNC5936 during Cleo MFT exploits in 2024. Researchers also noted that the main payload in the Oracle EBS intrusion chain had overlaps with a CLI module present in GOLDTOMB. These overlaps, together with reuse of the CL0P extortion brand and one compromised account previously linked to FIN11, were cited as indicators of association, although reporting did not make a definitive attribution. High-confidence details in the provided content do not describe GOLDTOMB’s full infection vector or complete functionality beyond identifying it as a FIN11 backdoor with code overlap to the observed payloads.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The campaign reused CL0P contact emails and showed technical links to GOLDVEIN.JAVA and GOLDTOMB malware used by FIN11/UNC5936 during Cleo MFT exploits in 2024.
The campaign reused CL0P contact emails and showed technical links to GOLDVEIN.JAVA and GOLDTOMB malware used by FIN11/UNC5936 during Cleo MFT exploits in 2024.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as malware previously used by FIN11/UNC5936 in 2024 Cleo MFT exploitation; this reporting notes technical links/overlap with the Oracle EBS campaign but does not describe functionality here.
GOLDTOMB is a backdoor associated with FIN11, used for persistent access and command execution on compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.