GoldenJackal

GoldenJackal is an advanced persistent threat active since 2019.^[1]

Targets

According to Kaspersky targets include the governments of Afghanistan, Azerbaijan, Iran, Iraq, Pakistan and Turkey.^[1][2]

They have also targeted the European Union in 2022.^[3]

Methods

Some attacks have been seen to use the Follina vulnerability.^[1] This exploit uses malicious Microsoft Word documents that execute PowerShell commands via the Microsoft Support Diagnostic Tool.^[4]

Toolkit

In the attack on the European Union a new toolkit was noted by ESET.^[3][2] This included code written in Go and Python.^[3][2] This toolkit can steal documents from airgapped machines by some elements of the kit infecting machines via USB flash drive.^[3][2] Infected machines that aren't connected to a network can hide stolen documents on a USB drive in a way that infected machines connected to a network can retrieve and send to attacker.^[3][2]

Possible Russian connection

ESET noted that the command and control protocol used by the groups malware is typically used by Turla, which is connected the Federal Security Service of Russia, suggesting the group may be Russian speakers.^[5]