FIN6
Golden Chickens is a malware-as-a-service (MaaS) provider. The content states it is known to have been used by groups such as FIN6 and Cobalt Group. Reported Golden Chickens tools include More_eggs, TerraPreter, TerraStealer, and TerraTV. The content also links the malware suite to TA4557 activity and notes historical overlap between TA4557 and reporting on FIN6, while the same malware suite has also been observed with Cobalt Group and Evilnum. Since at least October 2023, TA4557 has targeted recruiters with benign initial emails that, after reply, lead to fake resume sites, CAPTCHA-gated ZIP downloads, an LNK-based living-off-the-land execution chain abusing ie4uinit.exe, scriptlet and DLL stages, WMI and MSXSL execution, anti-sandbox and anti-debugging checks, RC4 key retrieval, and ultimately delivery of the More_Eggs backdoor. More_Eggs is described as capable of establishing persistence, profiling the machine, and delivering additional payloads. Aliases present in the content include Camouflage Tempest, FIN6, Gold Franklin, ITG08, Magecart Group 6, Skeleton Spider, Storm-0538, TA4557, TAAL, and Venom Spider.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
35 malware families attributed to this actor across reporting.
30 additional families tracked in Mallory.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.
FIN6 ... targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
FIN6 ... targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
The following analytic detects when su runs from a page-cache-corrupted binary... This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access... CVE CVE-2026-31431 ... References ... copy-fail-CVE-2026-31431
1 more CVE tied to this actor tracked in Mallory.
Observables
94 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Uses Windows Credential Editor and Metasploit PsExec NTDSGRAB to dump credentials and obtain copies of Active Directory databases.
Listed in the detection annotations as a threat actor associated with this analytic context.
Named threat actor referenced in global threat reporting.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.