Loading malware…
GoldenEagle is an Android surveillance malware family associated with China-linked mobile espionage activity targeting the Uyghur community and, to a lesser extent, Tibetans. It has been identified as part of a broader cluster of Android surveillance tools that includes SilkBean, DoubleAgent, and CarbonSteal, and has been linked to activity associated with GREF, also known as APT15, Ke3chang, Mirage, Vixen Panda, and Playful Dragon. Campaign activity has been observed since at least 2013 and has extended beyond China, with indications of targeting across multiple countries.
GoldenEagle is commonly embedded into trojanized legitimate Android applications that preserve expected functionality while adding covert surveillance features. Observed lures have included applications popular within the Uyghur community as well as VPN, messaging, social networking, gaming, adult-media, and search-related apps. Distribution has been associated with targeted phishing and fake third-party app stores rather than official app marketplaces.
The malware’s functionality centers on device surveillance, discovery, and data theft. It can enumerate installed applications, collect SMS messages, call logs, and contact lists, retrieve files from external storage, and take photos using the device camera. GoldenEagle also supports unauthorized SMS sending to attacker-controlled numbers, indicating both surveillance and active device abuse capabilities. For command and control and exfiltration, it uses standard application-layer protocols, including HTTP POST for C2 and both HTTP and SMTP for data exfiltration, helping its traffic blend with normal network activity.
GoldenEagle fits the profile of mobile spyware used for targeted intelligence collection against specific ethnic and regional communities, with emphasis on harvesting personal communications, social graphs, and locally stored content from compromised Android devices.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Lookout Threat Intelligence team has discovered four Android surveillanceware tools, which we named SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.
Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android surveillanceware used in larger China-linked mobile APT campaigns to gather and exfiltrate personal user data to attacker-operated command-and-control servers; many samples were trojanized legitimate apps.
GoldenEagle is an Android surveillanceware used by APT15 for espionage against targeted individuals.
Surveillanceware family discussed in relation to shared/adjacent infrastructure with DoubleAgent activity and links inferred from insecure C2/admin-panel artifacts.
Trojan referenced as another malware family previously used by GREF in related targeting activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.