GoldenJackal

GoldenJackal is a threat actor known for its advanced persistent threat (APT) activities, targeting air-gapped systems in government and diplomatic entities across Europe, the Middle East, and South Asia. The group utilizes spear-phishing, vulnerability exploitation, and a .NET malware toolset to establish persistence in victims' machines, spread across systems, and exfiltrate valuable information such as account credentials, system information, browser history, and user files. GoldenJackal's attacks have been notably intricate, deploying custom-made malware and using legitimate tools like Plink and PsExec for post-compromise operations. The group has developed unique capabilities that allow it to copy files from air-gapped systems and move them to connected systems via USB drives for exfiltration. Encryption algorithms such as XOR, Fernet, and AES are used to encrypt configuration files and files to be exfiltrated, adding an extra layer of complexity to their operations. GoldenJackal's toolset, which includes the JackalControl and JackalSteal malware, was deployed through compromised WordPress websites, demonstrating their ability to exploit existing infrastructures for their operations. Researchers at ESET have been tracking GoldenJackal's activities, providing crucial insights into their tactics, techniques, and procedures (TTPs). The threat actor has demonstrated considerable adaptability and sophistication, developing its own custom malware and using cloud storage services like Google Drive to store exfiltrated files. This highlights the group's capacity to leverage both malicious software and legitimate tools to conduct their operations effectively. As GoldenJackal continues to evolve, it poses a significant threat to governmental organizations and necessitates ongoing vigilance and robust cybersecurity measures.