S0493 GoldenSpy

malwareEnterprise

platformsWindows

also known asGoldenSpy

GoldenSpy is a backdoor malware which has been packaged with legitimate tax preparation software. GoldenSpy was discovered targeting organizations in China, being delivered with the "Intelligent Tax" software suite which is produced by the Golden Tax Department of Aisino Credit Information Co. and required to pay local taxes.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1027.013Encrypted/Encoded File
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1059.003Windows Command Shell
T1070.004File Deletion
T1071.001Web Protocols
T1082System Information Discovery
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1106Native API
T1136.001Local Account
T1195.002Compromise Software Supply Chain
T1497.003Time Based Checks
T1543.003Windows Service
T1571Non-Standard Port

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan