Gold Dragon

ATP Sandbox Adv. HeuristicsNetskope IPS

Stats

First seen: March 2022
Last seen: October 2026

Also known as

GoldDragonGolddragon

MITRE ATT&CK techniques

14 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion

TA0007 Discovery

T1012Query Registry
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1685Disable or Modify Tools

Associated groups

G0094Kimsuky

Alert name variants

Alert Name	Engine
Win32.Trojan.Golddragon	ATP Sandbox Adv. Heuristics
Win32.Trojan.GoldDragon	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Downloader.GOLDDRAGON.C2 Communication detected	IPS-SWG

Related families

Bazar InvisiMole QakBot Zebrocy Crimson