GoldMax

Description

GoldMax is a second stage command and control backdoor written in Go, with Windows and Linux variants of nearly identical functionality. Investigators discovered it in early 2021 during the SolarWinds Compromise investigation, and APT29 has likely used it since at least mid 2019, relying on defense evasion techniques that include avoiding virtualized execution and masking its traffic.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

Sunshuttle

MITRE ATT&CK techniques

18 techniques across 5 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
- T1053.003Cron
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.004Masquerade Task or Service
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
- T1497.001System Checks
T1564Hide Artifacts
- T1564.011Ignore Process Interrupts

TA0007 Discovery

T1016System Network Configuration Discovery
T1124System Time Discovery

TA0011 Command and Control

T1001Data Obfuscation
- T1001.001Junk Data
T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G0016APT29

Associated campaigns

C0024SolarWinds Compromise

Alert name variants

Alert Name	Engine
Generic.GoldMax.A.0F52032B	AV
Generic.GoldMax.A.6736A5F4	AV
Generic.GoldMax.A.CE0379AC	AV
Generic.GoldMax.A.F92A6C30	AV
Text.Trojan.Sunshuttle	ATP Sandbox Adv. Heuristics
Win64.Backdoor.GoldMax	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Sunshuttle	ATP Sandbox Adv. Heuristics
Win64.Trojan.GoldMax	ATP Sandbox Adv. Heuristics

Related families

Bazar PlugX Bisonal QakBot Latrodectus