- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2019
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0205 · goldenjackal
What it is
GoldenJackal activity is characterized by the use of compromised WordPress websites as a method to host C2-related logic. Kaspersky believes the attackers upload a malicious PHP file that is used as a relay to forward web requests to another backbone C2 server. They developed a collection of .NET malware tools known as Jackal.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Golden Jackal
Targets
- Countries
- Afghanistan, Azerbaijan, Germany, Iran, Iraq, Pakistan, Türkiye
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- GOlden Phoenix
- JackalControl
- JackalPerInfo
- JackalScreenWatcher
- JackalSteal
- JackalWorm
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de