GoldMax
GoldMax is a second-stage C2 backdoor written in Go that was used by APT29 and discovered in early 2021 during the investigation into breaches related to the SolarWinds intrusion. GoldMax uses multiple defense evasion techniques, including avoiding virtualization execution and masking malicious traffic.[1][2]
Associated Software Descriptions
| Name | Description |
|---|---|
| SUNSHUTTLE |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.[1][2] |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
GoldMax can spawn a command shell, and execute native commands.[1][2] |
| Enterprise | T1001 | .001 | Data Obfuscation: Junk Data |
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.[1] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information |
GoldMax has decoded and decrypted the configuration file when executed.[1][2] |
|
| Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
GoldMax has RSA-encrypted its communication with the C2 server.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel |
GoldMax can exfiltrate files over the existing C2 channel.[1][2] |
|
| Enterprise | T1105 | Ingress Tool Transfer | ||
| Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
GoldMax has impersonated systems management software to avoid detection.[1] |
| .005 | Masquerading: Match Legitimate Name or Location |
GoldMax appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.[1] |
||
| Enterprise | T1027 | Obfuscated Files or Information |
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.[1][2] |
|
| .002 | Software Packing | |||
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
GoldMax has used scheduled tasks to maintain persistence.[1] |
| Enterprise | T1016 | System Network Configuration Discovery |
GoldMax retrieved a list of the system's network interface after execution.[1] |
|
| Enterprise | T1124 | System Time Discovery |
GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.[1][2] |
|
| Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to |
| .003 | Virtualization/Sandbox Evasion: Time Based Evasion |
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.[1] |
||
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0016 | APT29 |
References
- Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
- Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021.
- NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.