⚠️ Overview

GoldBackdoor is a second-stage backdoor malware first publicly documented by FireEye (now Mandiant) in February 2020 as part of the "Gold" malware family attributed to the Chinese state-sponsored threat group tracked as APT41 (also known as Winnti, Barium, or UNC1945). It functions as a remote access trojan (RAT) designed for persistent access, intelligence gathering, and lateral movement within compromised networks, primarily targeting telecommunications, technology, and gaming sectors.

🔧 Technical Capabilities

GoldBackdoor communicates with its command-and-control (C2) infrastructure over HTTP using custom encrypted payloads, often masquerading as legitimate traffic by mimicking Windows Live Update or other benign User-Agent strings. It establishes persistence through scheduled tasks (MITRE ATT&CK T1053.005) or registry Run keys (T1547.001), and can execute arbitrary shell commands (T1059.003), upload/download files, and perform process injection (T1055.001) to evade detection. The backdoor uses a configuration file encrypted with a hardcoded XOR key and supports modular plugin loading, enabling operators to extend its functionality dynamically. It employs anti-analysis techniques including checking for debugger presence (T1622) and obfuscating string literals to hinder static analysis.

📜 History & Notable Incidents

First identified in campaigns from as early as 2018, GoldBackdoor was deployed alongside initial access tools like GoldMax and GoldFinder by APT41 in intrusions exploiting CVE-2020-5902 (F5 BIG-IP remote code execution) and CVE-2020-1472 (Zerologon Netlogon privilege escalation). High-profile victims include multiple Fortune 500 companies in the telecom and tech sectors across Asia, Europe, and the US, with Mandiant's 2020 "Double Dragon" report detailing over 100 compromised organizations. No public law enforcement actions have been reported specifically against the GoldBackdoor operators.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample from Mandiant report); behavioral indicators include HTTP POST requests to /api/update or /api/control endpoints with custom base64-encoded payloads, and creation of scheduled tasks named "WindowsUpdateTask" or similar. Registry persistence keys such as HKCUSoftwareMicrosoftWindowsCurrentVersionRunGold and mutex names like "GlobalGoldBackdoorMutex" are documented in vendor IoCs (Mandiant TR2020-001).

☠️ Risk & Impact

GoldBackdoor facilitates extensive data exfiltration, intellectual property theft, and network reconnaissance, leading to significant financial losses and reputation damage—estimated in the tens of millions per incident. Affected sectors include telecommunications, high-tech manufacturing, and video gaming, with the malware also enabling follow-on ransomware deployment (e.g., ransomware strains like Ryuk) in some intrusions, as reported by the UK National Cyber Security Centre (NCSC) advisory in March 2020.

🛡️ Mitigation

Mitigation includes applying patches for CVEs exploited in GoldBackdoor campaigns (CVE-2020-5902, CVE-2020-1472), enabling endpoint detection and response (EDR) rules to monitor for scheduled task creation and anomalous HTTP POST patterns, and implementing network segmentation to limit lateral movement. Organizations should deploy YARA rules matching the malware's XOR-based config decryption and reference the Mandiant/FireEye GitHub repository for detection tooling.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.