Golden Chickens

Golden Chickens, also known as More_eggs, is a stealthy and capable malware suite primarily used by financially-motivated cybercrime groups such as the Cobalt Group and FIN6. The malware was initially discovered in 2018 and has been primarily targeting organizations in Southeast Asia, stealing sensitive information like intellectual property and geopolitical intelligence from compromised systems. Its distribution is attributed to Venom Spider, an underground Malware-as-a-Service (MaaS) provider also known as badbullzvenom, according to Trend Micro. The threat actor behind Golden Chickens, Venom Spider, has been tracked down by Elite Threat Hunters. Identified as one of two criminals operating under the name "badbullzvenom" on the Russian-language Exploit.in forum, he has been characterized as the true mastermind behind the malware suite. His accomplice, known as "Chuck from Montreal," was found to have collaborated with him on the dark web from late 2012 to October 2013. Together, they released Multiplier and VenomKit in 2015 and 2017 respectively, which were later consolidated into Golden Chickens. In a significant breakthrough, cybersecurity firm eSentire uncovered the identity of the second developer of the Golden Chickens malware, due to a fatal operational security blunder. Revealed on May 22, 2023, the second developer was identified as a Romanian named Jack, who also goes by the names Lucky and badbullzvenom. Jack's identity unmasking has provided valuable insight into the operations of the Golden Chickens malware, further aiding efforts to combat this persistent cyber threat.