S0588 GoldMax

malwareEnterprise

platformsWindows · Linux

also known asGoldMax · SUNSHUTTLE

GoldMax is a second-stage C2 backdoor written in Go with Windows and Linux variants that are nearly identical in functionality. GoldMax was discovered in early 2021 during the investigation into the SolarWinds Compromise, and has likely been used by APT29 since at least mid-2019. GoldMax uses multiple defense evasion techniques, including avoiding virtualization execution and masking malicious traffic.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1001.001Junk Data
T1016System Network Configuration Discovery
T1027.002Software Packing
T1027.013Encrypted/Encoded File
T1036.004Masquerade Task or Service
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1053.003Cron
T1053.005Scheduled Task
T1059.003Windows Command Shell
T1071.001Web Protocols
T1105Ingress Tool Transfer
T1124System Time Discovery
T1140Deobfuscate/Decode Files or Information
T1497.001System Checks
T1497.003Time Based Checks
T1564.011Ignore Process Interrupts
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0016APT29

used by campaigns (1)

Campaigns that use this.

C0024SolarWinds Compromise

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan