S0597 GoldFinder

malwareEnterprise

platformsWindows

also known asGoldFinder

GoldFinder is a custom HTTP tracer tool written in Go that logs the route a packet takes between a compromised network and a C2 server. It can be used to inform threat actors of potential points of discovery or logging of their actions, including C2 related to other malware. GoldFinder was discovered in early 2021 during an investigation into the SolarWinds Compromise by APT29.

01

techniques used (3)

ATT&CK techniques this enables or maps to.

02

used by groups (1)

Threat groups associated with this.

03

used by campaigns (1)

Campaigns that use this.

04

source

Where this definition is published.

view on ATT&CK
scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan