GoldenSpy
MITRE ATT&CK: S0493 View on attack.mitre.org
Aliases: GoldenSpy
- Malware type
- backdoor
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 3
- Last IoC activity
- 2026-03-03 18:21:18
- Profile updated
- 2026-07-07 15:00:24
Targeted industries: government-and-public-sector financial-services
Targeted regions: country_code:cn
Context
GoldenSpy is a backdoor malware which has been packaged with legitimate tax preparation software. GoldenSpy was discovered targeting organizations in China, being delivered with the "Intelligent Tax" software suite which is produced by the Golden Tax Department of Aisino Credit Information Co. and required to pay local taxes.
Detection coverage
- 2 YARA rules
- 281 Sigma rules
Malware & tools used
- Windows Service (attack-pattern)
- System Information Discovery (attack-pattern)
- Local Account (attack-pattern)
- Non-Standard Port (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Compromise Software Supply Chain (attack-pattern)
- Match Legitimate Resource Name or Location (attack-pattern)
- Native API (attack-pattern)
- Windows Command Shell (attack-pattern)
- File and Directory Discovery (attack-pattern)
- File Deletion (attack-pattern)
- Web Protocols (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Time Based Checks (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
Detection rules
- SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 (yara-rule)
- MALPEDIA_Win_Goldenspy_Auto (yara-rule)
Reports & references
- atlanticcouncil.org — Breaking Trust Shades Of Crisis Across An Insecure Software Supply Chain (report)
- trustwave.com — Goldenspy Chapter 4 Goldenhelper Malware Embedded In Official Golden Tax Software (report)
- cert.ssi.gouv.fr — Certfr 2022 Cti 007 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Goldenspy (report)
- trustwave.azureedge.net — The Golden Tax Department And Emergence Of Goldenspy Malware (report)
- ic3.gov — 201103 1 (report)
- ic3.gov — 200728 (report)
- cert.ssi.gouv.fr — Certfr 2022 Cti 006 (report)
- trustwave.com — Goldenspy Chapter Two The Uninstaller (report)
- trustwave.com — The Golden Tax Department And The Emergence Of Goldenspy Malware (report)
- trustwave.com — Goldenspy Chapter 3 New And Improved Uninstaller (report)
- bka.de — Warnhinweisgoldenspy (report)
- MITRE ATT&CK — S0493 (report)
- trustwave.com — The Golden Tax Department And The Emergence Of Goldenspy Malware (report)