GoldenSpy

Description

GoldenSpy is a backdoor that shipped packaged with legitimate tax preparation software required to pay taxes in China. Researchers discovered it delivered with the Intelligent Tax suite produced by a Chinese tax software company, giving it a covert distribution channel into organizations doing business there.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

Goldenspy

MITRE ATT&CK techniques

15 techniques across 7 tactics.

TA0001 Initial Access

T1195Supply Chain Compromise
- T1195.002Compromise Software Supply Chain

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API

TA0003 Persistence

T1136Create Account
- T1136.001Local Account
T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1571Non-Standard Port

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Alert name variants

Alert Name	Engine
Win32.Backdoor.Goldenspy	ATP Sandbox Adv. Heuristics
Win32.Backdoor.GoldenSpy	ATP Sandbox Adv. Heuristics
Win32.Trojan.Goldenspy	ATP Sandbox Adv. Heuristics
Win32.Trojan.GoldenSpy	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Goldenspy	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
INDICATOR-COMPROMISE Win.Trojan.GoldenSpy download attempt	IPS-SWG

Related families

Bisonal PlugX KONNI Metamorfo TrickBot