From 9c85cbc22376738d5244b3313363dddceef102bd Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 20 Feb 2024 05:22:26 -0800
Subject: [PATCH] [threat-actors] Add GoldFactory

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b95b4dd..b049147 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -15258,6 +15258,17 @@
       },
       "uuid": "264d9a4b-9b0b-416f-9b09-819e96967a30",
       "value": "Cyber.Anarchy.Squad"
+    },
+    {
+      "description": "GoldFactory is a threat actor group attributed to developing sophisticated mobile banking malware targeting victims primarily in the Asia-Pacific region, specifically Vietnam and Thailand. They utilize social engineering to deliver malware to victims' devices and have close connections to the Gigabud malware family. GoldFactory's Trojans, such as GoldPickaxe and GoldDigger, employ tactics like smishing, phishing, and fake login screens to compromise victims' phones and steal sensitive information. Their evolving malware suite demonstrates a high level of operational maturity and ingenuity, requiring a proactive and multi-faceted cybersecurity approach to detect and mitigate their threats.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://www.group-ib.com/blog/goldfactory-ios-trojan/"
+        ]
+      },
+      "uuid": "74268518-8dd9-4223-9f7f-54421463cdb3",
+      "value": "GoldFactory"
     }
   ],
   "version": 301