Full Report
Insikt Group identifies four new TAG-195 malware families, revealing an architectural transition toward modular, operator-driven tooling in the MaaS ecosystem
Analysis Summary
# Tool/Technique: TAG-195 Modular Malware Ecosystem
## Overview
TAG-195 (also known as "Golden Chickens" or "Venom Spider") is a financially motivated Malware-as-a-Service (MaaS) developer. The group has transitioned its architecture toward a highly modular, operator-driven ecosystem. This evolution allows for selective provisioning of capabilities, reduced static detection footprints, and enhanced persistence through the use of legitimate Windows system utilities and "ClickFix" social engineering.
## Technical Details
- **Type:** Malware Family / MaaS Ecosystem
- **Platform:** Windows
- **Capabilities:** Host profiling, interactive shell, browser credential theft (bypassing Chrome App-Bound Encryption), session automation, network reconnaissance, and modular plugin loading.
- **First Seen:** April 2025 (Initial reporting of predecessors); May 2026 (Current modular variants).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0002 - Execution]**
- [T1204.004 - User Execution: Malicious Copy and Paste]
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1218.010 - System Binary Proxy Execution: Regsvr32]
- [T1140 - Deobfuscate/Decode Files or Information]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1528 - Steal Application Access Token]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1046 - Network Service Discovery]
## Functionality
### Core Capabilities
- **TinyEgg:** A lightweight backdoor used for initial profiling, persistence management, and providing an interactive shell.
- **ChonkyChicken:** A comprehensive implant featuring built-in modules for browser session automation, network reconnaissance, and sustained surveillance.
- **Modular Architecture:** A variant of ChonkyChicken utilizing a controller-and-plugin model. It downloads discrete functional modules (at least 14 identified) from C2 on demand.
- **Persistence:** Consistent use of Registry Run keys and execution via legitimate binaries (e.g., `regsvr32.exe`).
### Advanced Features
- **ChromEggscalator:** A custom helper tool modified from public sources to bypass Google Chrome's App-Bound Encryption (ABE) to steal stored credentials.
- **Credential-Backed Execution:** Using stolen credentials to facilitate remote execution across compromised networks.
- **ClickFix Delivery:** Tricking victims into executing malicious commands via fake security verification pages.
## Indicators of Compromise
- **File Hashes (SHA256):** `5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c` (ChonkyChicken)
- **File Names:** `chromelevator.ocx`, `wpad_capture.ocx`, `lg.txt`
- **Registry Keys:** Consistent value names under `Software\Microsoft\Windows\CurrentVersion\Run`
- **Network Indicators:** Outbound traffic to attacker-controlled infrastructure (Note: Indicators should be defanged, e.g., `hxxp[://]example[.]com`)
- **Behavioral Indicators:** `regsvr32.exe` loading `.ocx` files from user-writable directories; browser processes launched with `--remote-debugging-port`.
## Associated Threat Actors
- **TAG-195 (Golden Chickens / Venom Spider):** Developer/MaaS Provider.
- **TAG-127:** Known operator/customer using ClickFix campaigns.
- **FIN6, Cobalt Group, Evilnum:** Historically linked to TAG-195 tooling.
## Detection Methods
- **Signature-based:** Use of YARA rules (e.g., `MAL_TAG195_ChonkyChicken`) targeting specific strings like `Koki cmd=`, `Blat path=`, and `token_run`.
- **Behavioral:** Monitor for suspicious "ClickFix" clipboard activities and unauthorized `regsvr32.exe` execution.
- **EDR/SIEM:** Detect command lines containing `regsvr32` referencing local `.ocx` files in `AppData` or other writable paths.
## Mitigation Strategies
- **Prevention:** Implement strict Application Control to prevent execution from user-writable directories.
- **Hardening:** Disable or restrict legitimate system utilities like `regsvr32.exe` if not required for business operations.
- **Education:** Train users to recognize "ClickFix" social engineering prompts (fake "Verify you are human" buttons that require pasting commands).
## Related Tools/Techniques
- **TerraStealerV2 / TerraLogger:** Earlier, less modular versions of TAG-195 tooling.
- **VenomLNK:** An alternative delivery method used by TAG-195 customers.