Loading threat actor…
GooNky is a threat group associated with consumer-focused malvertising campaigns, including activity targeting France in April 2016. Its infection chains used the Angler exploit kit before migrating to Neutrino following Angler's disappearance from the exploit-kit market. GooNky exploited browser information disclosure vulnerabilities CVE-2016-3298 and CVE-2016-3351 to profile visitors' software and configurations and exclude security researchers, security vendors, and sandbox environments. These checks helped selectively direct ordinary consumers into exploitation chains while evading automated analysis. CVE-2016-3298 affects Internet Explorer, while CVE-2016-3351 affects Internet Explorer and Microsoft Edge. Both vulnerabilities were observed together in GooNky infection chains in April 2016. Exploitation code for CVE-2016-3298 appeared in Neutrino shortly after GooNky migrated to that exploit kit.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
2 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
On September 13, 2016 Microsoft released a security bulletin fixing the CVE-2016-3351 vulnerability, which included a patch for Internet Explorer and Edge browsers. Researchers found exploitation dating back to January 2014, including a malvertising chain leading to Angler EK and dropping Reveton.
Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a “GooNky” infection chain along with CVE-2016-3351. Code exploiting CVE-2016-3298 was subsequently observed in AdGholas campaigns, Neutrino EK, and a NeutrAds malvertising chain.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates malvertising infection chains that exploit information-disclosure vulnerabilities to filter potential victims and evade security analysis. Its April 2016 French campaign used CVE-2016-3298 and CVE-2016-3351. Following Angler's disappearance, the actors migrated their campaign to Neutrino EK.
Used CVE-2016-3351, with an example documented on April 18, 2016. Its exploitation code is presented as a comparison to AdGholas's differently obfuscated implementation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.