GoldMax
Software · ATTACK:enterprise:S0588
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0588",
"title": "GoldMax",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0588",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5c747acd-47f0-4c5a-b9e5-213541fc01e0",
"external_id": "S0588",
"domain": "enterprise",
"created": "2021-03-12T16:10:45.416Z",
"modified": "2024-04-11T02:26:45.606Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "SUNSHUTTLE"
},
{
"source_name": "GoldMax"
},
{
"source_name": "CrowdStrike StellarParticle January 2022",
"url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
},
{
"source_name": "MSTIC NOBELIUM Mar 2021",
"url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
},
{
"source_name": "FireEye SUNSHUTTLE Mar 2021",
"url": "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--005b6fd1-be80-424b-b6df-2ff88d390b1b
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bb1573c-f30f-449c-931e-c5de024e96f8
FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0588
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--111d5f78-f5d3-4c33-b5f8-d978c166b52a
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1564.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--270284ac-af4d-47dc-9218-26fbecd2ed9a
CrowdStrike StellarParticle January 2022ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ff84270-830f-4de8-b93c-4ee3a9a46781
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0588
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48c43e15-210c-491f-9198-928b583470d9
MSTIC NOBELIUM May 2021 · MSTIC Nobelium Toolset May 2021 · MSTIC NOBELIUM Mar 2021 · Cybersecurity Advisory SVR TTP May 2021 · Secureworks IRON RITUAL ProfileATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57ac1c4f-03fb-4b9e-a4b3-21eb76e7e305
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1053.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f336eb-31e7-4904-9ed4-07ca68cd3838
CrowdStrike StellarParticle January 2022ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7962fea5-a94d-4bb3-b951-fb8726bc4f67
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9818aba3-86c8-416b-ab47-dc160c80b931
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99e6e6cb-c19e-4689-8c92-b5429c709b91
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6a4bbf3-7a2e-46ae-877a-614bf9f81644
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae8e960c-3842-4dd5-abab-31d35c0fd1fd
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3dbb1d8-2404-4514-8ae7-f0f58b198fb0
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb1a7fc8-bec0-4655-bbfe-0c786e237452
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf672181-ef16-4d3a-a587-9ac82ac87b8a
MSTIC NOBELIUM Mar 2021 · CrowdStrike StellarParticle January 2022ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbc18998-67f4-493a-b0d3-4aa50da3c407
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7a5d884-d3d9-48c8-915f-75d29d4b259e
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd06ea48-6dde-4753-8f2b-c2fb56bea4f4
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3a6ce37-9b55-481f-9dc2-8de69f77a674
MSTIC NOBELIUM Mar 2021