Full Report
A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as Gigaflower, shared criminal infrastructure, and insights from the Group-IB Fraud Matrix, with recommendations for organizations and end users.
Analysis Summary
# Threat Actor: GoldFactory
## Attribution & Identity
* **Actor Name:** GoldFactory
* **Identity:** A sophisticated, financially motivated cybercrime group.
* **Known Associations:** The group is known for developing highly specialized banking trojans and is linked to the development and distribution of the GoldDigger malware family.
## Activity Summary
GoldFactory is currently engaged in aggressive, evolving mobile fraud campaigns across the Asia-Pacific (APAC) region. Recent operations involve the deployment of a new, highly sophisticated Android malware variant named **Gigaflower**. The actor has transitioned from simple credential harvesting to implementing advanced features like real-time screen streaming and remote interaction via Accessibility Services. Their campaigns often involve impersonating government agencies or utility providers to trick users into installing malicious applications (often disguised as "system updates" or "security tools").
## Tactics, Techniques & Procedures
* **Social Engineering:** Uses smishing (SMS phishing) and social media lures to direct victims to malicious websites.
* **Malicious App Distribution:** Distributes malware via side-loading (APK files) through websites impersonating official government portals or the Google Play Store.
* **Abuse of Accessibility Services:** Heavily relies on Android’s Accessibility Services to intercept SMS, log keystrokes, and perform automated clicks/gestures.
* **Remote Access:** Uses WebRTC for real-time screen streaming, allowing the actor to view the victim's screen in real-time to bypass 2FA.
* **Overlay Attacks:** Displays fake login windows (Fake PIN, Fake Fingerprint, Fake Facial Recognition) to harvest sensitive credentials.
* **Device Takeover:** Capable of locking the screen or preventing the user from uninstalling the app by automatically closing system dialogs.
**MITRE ATT&CK IDs (Associated):**
* **T1478:** Install Malicious Application
* **T1418:** Software Discovery
* **T1636.002:** SMS Messaging
* **T1516:** Input Injection
* **T1624:** Event Triggered Execution (Accessibility Service)
* **T1513:** Screen Capture
## Targeting
* **Sectors:** Banking and Finance, Government Services, Utility Providers.
* **Geography:** Primarily Southeast Asia (Thailand, Vietnam) and the broader APAC region.
* **Victims:** Individual banking customers and users of government mobile applications.
## Tools & Infrastructure
* **Malware Families:**
* **GoldDigger:** The original banking trojan.
* **GoldDiggerPlus:** An enhanced version with broader targeting.
* **Gigaflower:** The latest variant featuring advanced remote control and WebRTC capabilities.
* **Infrastructure:**
* **C2 Communication:** Utilizes specific API endpoints for data exfiltration (e.g., `hxxp[:]//[c2-address]/fronted/createApps`, `hxxp[:]//[c2-address]/fronted/createKeyboardInput`).
* **WebRTC:** Used for high-speed, low-latency screen streaming.
* **Shared Infrastructure:** The group often reuses C2 domains and IP segments across different malware versions to streamline operations.
## Implications
GoldFactory represents a high-tier threat to the mobile banking ecosystem. Their shift toward "Interactive Fraud" (where they control the device in real-time) renders traditional static defenses like SMS-based 2FA largely ineffective. The development of Gigaflower suggests a dedicated R&D capability, indicating the group will continue to iterate on techniques to bypass OS-level security patches.
## Mitigations
* **Organization-level:**
* Implement behavioral-based fraud detection to identify automated or remote interactions within banking apps.
* Monitor for "side-loaded" applications and Accessibility Service abuse via mobile application security testing (MAST).
* Educate customers on the risks of government impersonation scams and the dangers of side-loading APKs.
* **End User-level:**
* Never download applications from unofficial sources or via links sent through SMS/social media.
* Disable "Install from Unknown Sources" in Android settings.
* Review App Permissions: Be extremely cautious if a simple utility app requests "Accessibility Services."