Loading malware…
GoldMax, also known as SUNSHUTTLE, is a Go-based, second-stage command-and-control backdoor with Windows and Linux versions. It is associated with NOBELIUM, also known as APT29 and Cozy Bear, a cyberespionage group attributed to Russia’s Foreign Intelligence Service. GoldMax has been deployed after initial compromise in SUNBURST-related intrusions associated with the SolarWinds supply-chain operation. Its targeting includes government and other public- and private-sector organizations in North America and Europe.
GoldMax supports remote command execution, including native operating-system commands, transfer of additional tools onto compromised systems, and file exfiltration over its existing command-and-control channel. It enumerates network interfaces and retrieves system date and time information, which it can compare against a hardcoded execution trigger and transmit to its controller. Windows deployments maintain persistence through scheduled tasks while masquerading as legitimate systems-management software.
The backdoor stores an encrypted configuration on disk and decodes and decrypts it during execution, using implant-specific AES-256 keys. It also uses RSA encryption for command-and-control communications and implant-specific cookies to support operational identification. A decoy network-traffic generation feature blends malicious communications with benign-looking activity, supporting stealth and persistent access.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GoldMax ... Command and Scripting Interpreter: Windows Command Shell ... Exfiltration Over C2 Channel ... Ingress Tool Transfer.
The malware presented in the workshop (Sunshuttle, from the DarkHalo APT, MD5 5DB340A70CB5D90601516DB89E629E43) is straightforward to the extent that it can be understood without paying too much attention to these objects.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.