Golden Chickens: A Compilation of our In-House Research

aSince uncovering the Malware-as-a-service provider “Golden Chickens” back in 2018, we are carefully tracking the evolution of the Golden Chickens (GC) Malware-as-a-Service provider (MaaS) and how different threat actors use it. Latest Golden Chickens Activity Lately, a new spear-phishing campaign is actively targeting LinkedIn members using personalized job offers as a lure. A threat actor […]

Allison Ebel

Read More »

Published in: Blog
April 6, 2021

aSince uncovering the Malware-as-a-service provider “Golden Chickens” back in 2018, we are carefully tracking the evolution of the Golden Chickens (GC) Malware-as-a-Service provider (MaaS) and how different threat actors use it.

Latest Golden Chickens Activity

Lately, a new spear-phishing campaign is actively targeting LinkedIn members using personalized job offers as a lure. A threat actor group is sending job offers that have the same name as that of the victims’ job titles from their LinkedIn profiles. Upon opening the ZIP file that comes with the fake offer, the stealthy installation of the fileless backdoor more_egg is initiated and will eventually allow the attacker to remotely control the victim’s computer.

About two weeks ago, we first observed a campaign resulting in the same C2. We attribute the activity to FIN6.

Our exclusive Intelligence on Golden Chickens is accessible in Mercury to all our clients. Wants to know more? Just contact us!

Talk to an Expert

To help you stay informed on the latest development, we created a compilation of all our public research on Golden Chickens.

Our Past Golden Chickens Research

#1 Golden Chickens: Uncovering a Malware-as-a-Service (MaaS) Provider

This blog post provides an overview on a specific Malware-as-a-Service (MaaS) used within the e-Crime threat actor landscape. It also provides details on two different threat actors using the MaaS that fall under the umbrella of a family we dubbed Golden Chickens: GC01 and GC02.

#2 The Chicken Keeps Laying New Eggs: Uncovering New GC MaaS Tools Used By Top-tier Threat Actors

In 2019, we uncovered and classified seven additional tools linked to the GC MaaS, which add to the four ones we uncovered in 2018.

#3 GOLDEN CHICKENS: Evolution of the MaaS

Throughout March and April 2020, QuoIntelligence (formerly: QuoINT) observed four attacks utilizing various tools from the Golden Chickens (GC) Malware-as-a-Service (MaaS) portfolio. We are now declassifying our findings for the general public.

Interested in becoming a premium customer?

Unlock exclusive benefits by becoming a premium customer

Written by: Allison Ebel

Share this article:

Golden Chickens: A Compilation of our In-House Research

Share this article:

Related Posts

10 Steps to Secure Your Organization Against Cybercrime

10 Steps To Secure Your Organization Against Cybercrime

IT security and rising cybercrime activities is a growing area of concern across many organizations. Here are ten essential areas, you should carefully focus your efforts on to succeed in cybersecurity.

Allison Ebel March 9, 2021

APT28 Delivers Zebrocy Malware Campaign Using NATO Theme as Lure

APT28 Delivers Zebrocy Malware Campaign using NATO Theme as Lure

Our declassified threat intelligence analysis on a APT28 spear phishing campaign delivering Zebrocy malware to target at least a government body in the Middle East using a NATO course as a lure.

Allison Ebel September 22, 2020

Blackwater

BlackWater Malware Leveraging Beirut Tragedy in New Targeted Campaign

You can find here the latest threat intelligence updates on the new BlackWater Malware campaign using the Beirut tragedy to lure targets.

Allison Ebel August 7, 2020

Latest Golden Chickens MaaS Tools Updates and Observed Attacks

GOLDEN CHICKENS: Evolution of the MaaS

Learn more about the Golden Chickens Malware-as-a-Service tool updates observed in recent malware campaigns against the financial, retail, and chemical sectors.

Allison Ebel July 20, 2020