GOLD CABIN

Also known as Shakthak, TA551, ATK236, G0127, Monster Libra, Shathak

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

GOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads are most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak. GOLD CABIN infrastructure relies on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1027.003 Steganography T1027.010 Command Obfuscation T1036 Masquerading T1059.003 Windows Command Shell T1071.001 Web Protocols T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1204.002 Malicious File T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1566.001 Spearphishing Attachment T1568.002 Domain Generation Algorithms T1589.002 Email Addresses

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.