MalwareUsed by 2 actors

GoldMax

Also known asSUNSHUTTLE

GoldMax, also known as SUNSHUTTLE, is a Go-based, second-stage command-and-control backdoor with Windows and Linux versions. It is associated with NOBELIUM, also known as APT29 and Cozy Bear, a cyberespionage group attributed to Russia’s Foreign Intelligence Service. GoldMax has been deployed after initial compromise in SUNBURST-related intrusions associated with the SolarWinds supply-chain operation. Its targeting includes government and other public- and private-sector organizations in North America and Europe.

GoldMax supports remote command execution, including native operating-system commands, transfer of additional tools onto compromised systems, and file exfiltration over its existing command-and-control channel. It enumerates network interfaces and retrieves system date and time information, which it can compare against a hardcoded execution trigger and transmit to its controller. Windows deployments maintain persistence through scheduled tasks while masquerading as legitimate systems-management software.

The backdoor stores an encrypted configuration on disk and decodes and decrypts it during execution, using implant-specific AES-256 keys. It also uses RSA encryption for command-and-control communications and implant-specific cookies to support operational identification. A decoy network-traffic generation feature blends malicious communications with benign-looking activity, supporting stealth and persistent access.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT29

GoldMax ... Command and Scripting Interpreter: Windows Command Shell ... Exfiltration Over C2 Channel ... Ingress Tool Transfer.

via mitre attack websiteattack.mitre.org

Dark Halo

The malware presented in the workshop (Sunshuttle, from the DarkHalo APT, MD5 5DB340A70CB5D90601516DB89E629E43) is straightforward to the extent that it can be understood without paying too much attention to these objects.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1596Search Open Technical DatabasesEvidence1

During the 2021 edition of the SAS conference, I had the pleasure of delivering a workshop focused on reverse-engineering Go binaries.

Execution

3 techniques

T1053.003CronEvidence2

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

2 techniques

T1053.003CronEvidence2

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Privilege Escalation

2 techniques

T1053.003CronEvidence2

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Stealth

9 techniques

T1027.002Software PackingEvidence2

T1027.013Encrypted/Encoded FileEvidence2

T1036MasqueradingEvidence1

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.004Masquerade Task or ServiceEvidence2

T1036.005Match Legitimate Resource Name or LocationEvidence2

T1140Deobfuscate/Decode Files or InformationEvidence4

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1497.001System ChecksEvidence2

T1497.003Time Based ChecksEvidence2

T1564.011Ignore Process InterruptsEvidence2

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1124System Time DiscoveryEvidence3

The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".

T1497.001System ChecksEvidence2

T1497.003Time Based ChecksEvidence2

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Examples include: "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header," "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers," and "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."

T1001.001Junk DataEvidence2

T1071.001Web ProtocolsEvidence3

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1573.002Asymmetric CryptographyEvidence2

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

ADVSTORESHELL exfiltrates data over the same channel used for C2.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app1 year ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

41 SOURCESView more in app

cyble blogNews

Feb 20, 2025

Threat Actor Profile: APT29 - Cyble

Their toolkit includes 7-Zip, AdFind, ATI-Agent, AtNow, BEATDROP, BloodHound, CEELOADER, CloudDuke, Cobalt Strike, CosmicDuke, CozyDuke, Danfuan, EnvyScout, FatDuke, FoggyWeb, GeminiDuke, Geppei, GoldFinder, GoldMax...

securelistNews

Apr 27, 2022

APT trends report Q1 2022

Backdoor referenced as similar to the Tomiris Golang backdoor; no further technical detail provided in this content.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Retrieves a list of system network interfaces after execution.

security affairsNews

Dec 6, 2021

Nobelium APT targets French orgs, French ANSSI agency warns

Malware implant identified in the content as one of the families used in the SolarWinds-related activity by NOBELIUM.

+35 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GoldMax

Also known asSUNSHUTTLE