GoldMax

GoldMax is a sophisticated malware, initially discovered to target Windows platforms with the earliest identified timestamp indicating a compilation in May 2020. The malicious software was designed by threat actors to exploit and damage computer systems, often infiltrating without the user's knowledge through suspicious downloads, emails, or websites. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. To avoid detection, the threat actor renamed their utilities to masquerade as legitimate system binaries, match the system’s role, or appear legitimate. A recent investigation by CrowdStrike revealed that GoldMax has a more extensive reach than previously thought, with a variant built for the Linux platform deployed in mid-2019. This discovery was made during StellarParticle-related investigations where two advanced malware families were found on victim systems from around mid-2019: a Linux variant of GoldMax and a completely new family referred to as TrailBlazer. Both these malware families were associated with the same group behind the infamous SolarWinds attack, tracked by Malwarebytes as APT29/Cozy Bear. This group is well-known for deploying novel tactics, techniques, and procedures (TTPs), including the use of covert malware such as TrailBlazer and GoldMax Linux backdoor variant, which allowed them to go unnoticed for years. GoldMax operates by using an encrypted session key to communicate with its command-and-control (C2) server. The C2 commands are represented as seemingly random alphanumerical ASCII strings that are unique to each implant but known to the C2 server, enabling the operator to download and execute files on the compromised system, upload files from the compromised system to the C2 server, execute OS commands on the compromised system, spawn a command shell, and dynamically update GoldMax’s configuration data. The malware's configuration data contains an execution activation/trigger date, serving as an "activate after x date/time" feature, and can be dynamically updated to set a new activation date, replace the existing C2 URL and User-Agent values, enable/disable decoy network traffic feature, and update the number range used by its PRNG.