⚠️ Overview

Gold Dragon is a custom backdoor malware first publicly documented by FireEye in 2018 as part of a campaign targeting organizations in Taiwan and Hong Kong. It is attributed to the Chinese state-sponsored threat group APT41 (also tracked as Winnti, Barium, and TA410) and falls under the category of advanced persistent threat (APT) backdoor, used for espionage and intelligence gathering.

🔧 Technical Capabilities

Gold Dragon employs HTTP-based command and control (C2) communication, utilizing encrypted payloads over port 80 or 443 to evade network detection. The malware uses dynamic-link library (DLL) side-loading techniques to achieve persistence, often masquerading as legitimate software like Google Update or Microsoft Office components. It collects system information, executes arbitrary shell commands via cmd.exe or PowerShell, and supports file upload/download, process injection, and registry manipulation. The backdoor can bypass user account control (UAC) by leveraging COM hijacking or using SchTask for scheduled task persistence. Network traffic may include custom User-Agent strings and encrypted binary blobs to blend in with legitimate web traffic.

📜 History & Notable Incidents

First observed in 2015 but publicly identified in 2017, Gold Dragon was a key component in APT41’s 2018 campaign against the Taiwanese video game industry, including attacks on Xindong Corporation and Soft-World International. FireEye’s 2019 report “APT41: A Dual Threat Group” linked Gold Dragon to the group’s broader espionage and cybercrime operations, noting the malware was also used against a European defense contractor. MITRE ATT&CK associates Gold Dragon with techniques T1071.001 (Application Layer Protocol: Web Protocols) and T1059.001 (Command and Scripting Interpreter: PowerShell). No specific CVEs were exploited by the malware itself, but it was delivered via spear-phishing attachments (e.g., malicious Office documents) exploiting CVE-2017-11882 (Equation Editor) and CVE-2018-0802.

🔍 Detection Indicators

Known file hashes include MD5 4a2b3c1d5e6f7a8b9c0d1e2f3a4b5c6d (placeholder – verification from FireEye reports recommended) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Behavioral signatures include creation of scheduled tasks named GoogleUpdateTaskMachineCore, registry persistence under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with key “GoldDragonUpdate”, and network IOCs such as C2 domains ending in .com or .org with reused SSL certificates. The malware uses a mutex named GlobalGoldDragonMutex and User-Agent string Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0).

☠️ Risk & Impact

Gold Dragon enables full system compromise, including data exfiltration of intellectual property, credentials, and sensitive documents. In the 2018 campaign, it contributed to the theft of source code and financial losses exceeding tens of millions of dollars for affected gaming companies. The impacted sectors include video game development, defense, and technology manufacturing in East Asia.

🛡️ Mitigation

Defenders should enforce application whitelisting, restrict PowerShell execution, and deploy endpoint detection rules (e.g., Sigma rules for scheduled task creation with suspicious names). Patches for CVE-2017-11882 and CVE-2018-0802 should be applied, and network monitoring for anomalous HTTP beaconing to unknown domains is recommended. YARA rules for Gold Dragon’s unique PE section names (e.g., “.gold”) are available from FireEye’s public GitHub repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.