GoldenJackal  (Back to overview)

GoldenJackal activity is characterized by the use of compromised WordPress websites as a method to host C2-related logic. Kaspersky believes the attackers upload a malicious PHP file that is used as a relay to forward web requests to another backbone C2 server. They developed a collection of .NET malware tools known as Jackal.

Associated Families

There are currently no families associated with this actor.

2023-08-30Kaspersky LabsDavid Emm
IT threat evolution in Q2 2023
3CX Backdoor Bankshot BLINDINGCAN GoldMax Kazuar QUIETCANARY tomiris GoldenJackal
2023-05-23Kaspersky LabsGiampaolo Dedola
Meet the GoldenJackal APT group. Don’t expect any howls
Jackal GoldenJackal

Credits: MISP Project