MalwareUsed by 1 actor

GoldenEagle

GoldenEagle is an Android spyware family with samples dating to at least 2012. It has been used in China-linked mobile surveillance campaigns primarily targeting Uyghurs, including diaspora communities, and, at the broader campaign level, Tibetans. It belongs to an interconnected surveillance toolkit that includes SilkBean, DoubleAgent, and CarbonSteal and has been associated with GREF, also known as APT15.

GoldenEagle embeds malicious functionality in legitimate applications, including Uyghur community applications, VPN clients, instant messaging and social networking applications, games, adult media applications, and search utilities. These trojanized applications retain legitimate functionality while adding concealed surveillance capabilities. Distribution has involved phishing and third-party application channels rather than Google Play.

The malware collects SMS messages, contacts, call logs, and installed application names. It retrieves documents, text files, images, audio, Android application packages, and database files from external storage, and can take photographs using the device camera. GoldenEagle can also send SMS messages to an attacker-controlled number. It uses HTTP POST requests for command-and-control communications and exfiltrates collected data through both HTTP and SMTP.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Ke3chang

GoldenEagle samples are reported from as early as 2012, which makes it one of the longer-running families in the set.

via netaskari substacknetaskari.substack.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1189Drive-by CompromiseEvidence1

The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.

T1195Supply Chain CompromiseEvidence1

Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the com.golf package.

T1566PhishingEvidence1

The surveillance apps of these campaigns were likely distributed through a combination of targeted phishing and fake third-party app stores.

Stealth

1 technique

T1036MasqueradingEvidence1

Many samples of these malware tools were trojanized legitimate apps, i.e., the malware maintained complete functionality of the applications they were impersonating in addition to its hidden malicious capabilities.

Collection

1 technique

T1005Data from Local SystemEvidence4

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

The primary aim of these apps is to gather and exfiltrate personal user data to attacker-operated command-and-control servers.

T1048Exfiltration Over Alternative ProtocolEvidence1

GoldenEagle has exfiltrated data via both SMTP and HTTP.

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence1

BRATA has exfiltrated data to the C2 server using HTTP requests.

ACTIVITY FEED

Recent activity

28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

28 SOURCESView more in app

netaskari substackNews

Oct 3, 2026

Guest article: The Future-Past of digital espionage - APT15

Android surveillance family linked to the same mobile espionage cluster as SilkBean, DoubleAgent, and CarbonSteal. An exposed administration panel revealed GPS coordinates assessed as belonging to early test devices; its infrastructure also supported phishing.

lookout blogNews

Jan 1, 2026

Multiyear Surveillance Campaigns Discovered Targeting Uyghurs | Threat Intel

Android surveillanceware used in larger China-linked mobile APT campaigns to gather and exfiltrate personal user data to attacker-operated command-and-control servers; many samples were trojanized legitimate apps.

picus security blogNews

Dec 12, 2025

APT15 Cyber Espionage: Campaigns and TTPs Analysis

GoldenEagle is an Android surveillanceware used by APT15 for espionage against targeted individuals.

lookout blogNews

Jan 22, 2024

Lookout Discovers Surveillance Campaigns Targeting Uyghurs | Threat Intel

Surveillanceware family discussed in relation to shared/adjacent infrastructure with DoubleAgent activity and links inferred from insecure C2/admin-panel artifacts.

+24 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GoldenEagle