Full Report
ESET Research analyzed two separate toolsets for breaching air-gapped systems, used by a cyberespionage threat actor known as GoldenJackal
Analysis Summary
# Threat Actor: GoldenJackal
## Attribution & Identity
- Identified as a Cyberespionage Advanced Persistent Threat (APT) group.
- Active since at least 2019.
- Group is little known, reported publicly in 2023 by Kaspersky.
- Attribution to a specific nation-state cannot be made, but analysis of the GoldenHowl C&C protocol ("transport\_http") suggests developers might be Russian speakers, as this expression is typically used by Turla and MoustachedBouncer.
- Known toolset includes C# implants: JackalControl, JackalSteal, JackalWorm, JackalPerInfo, and JackalScreenWatcher.
## Activity Summary
- Active since at least 2019, primarily engaging in espionage.
- **2019 Activity:** Deployed custom tools capable of targeting air-gapped systems against a South Asian embassy in Belarus (detected in August and September 2019).
- **2020-2021 Activity:** Kaspersky reported limited attacks against government/diplomatic entities in the Middle East and South Asia starting in 2020; ESET detected activity at the South Asian embassy in Belarus again in July 2021.
- **2022-2024 Campaign:** Deployed a highly modular, previously undocumented toolset against a national government organization in a European Union country between May 2022 and March 2024.
## Tactics, Techniques & Procedures
- **Weaponization/Delivery:** Utilizes custom toolsets designed to breach and persist within air-gapped environments.
- **Discovery/Collection:** Tools are used to collect information, process it, and exfiltrate files.
- **Impact:** Ultimate goal is stealing confidential information, especially from high-profile air-gapped machines.
- **Data Staging:**
- [T1074.001] Data Staged: Local Data Staging (Most tools stage files locally for processing or exfiltration).
- Data staged in a specific, undocumented directory on a removable drive.
- **Collection:**
- [T1114.001] Email Collection: Local Email Collection (via GoldenBlacklist and GoldenPyBlacklist processing collected email files).
- **Command and Control (C2):**
- [T1071.001] Application Layer Protocol: Web Protocols (GoldenDealer and GoldenHowl use HTTPS).
- [T1092] Communication Through Removable Media (GoldenDealer uses removable media to pass executables to air-gapped systems and pass data out).
- [T1132.001] Data Encoding: Standard Encoding (Executables sent from C&C are base64 encoded).
- [T1572] Protocol Tunneling (GoldenHowl can forward messages via an SSH tunnel).
- [T1090.001] Proxy: Internal Proxy (GoldenHowl can act as an internal proxy).
- **Exfiltration:**
- [T1041] Exfiltration Over C2 Channel (GoldenHowl exfiltrates via its C&C channel).
- [T1052.001] Exfiltration Over Physical Medium: Exfiltration over USB (Capabilities exist to copy files from air-gapped systems to connected systems via USB).
- [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage (GoldenDrive exfiltrates to a controlled Google Drive account).
- [T1048.002] Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (GoldenMailer exfiltrates via SMTP on port 587 using STARTTLS).
## Targeting
- **Sectors:** Government and Diplomatic entities.
- **Geography:** Europe, the Middle East, and South Asia.
- **Victims:**
- A national government organization of a country in the European Union (May 2022 - March 2024).
- A South Asian embassy in Belarus (2019, 2021).
## Tools & Infrastructure
- **Malware families used:** JackalControl, JackalSteal, JackalWorm, JackalPerInfo, JackalScreenWatcher, GoldenBlacklist, GoldenPyBlacklist, GoldenDealer, GoldenHowl, GoldenDrive, GoldenMailer.
- GoldenDealer uses **removable media** for cross-network movement in air-gapped environments.
- GoldenDrive leverages **Google Drive** for exfiltration cloud storage.
- GoldenMailer uses **port 587 (SMTP with STARTTLS)** for exfiltration.
- C2 communication employs **HTTPS** (GoldenDealer, GoldenHowl) and potentially **SSH tunneling**.
## Implications
GoldenJackal demonstrates a high level of resourcefulness and sophistication by developing and deploying *two separate toolsets* specifically designed to breach and operate within air-gapped environments over a five-year period. This focus confirms the group's consistent goal to access highly sensitive, isolated data, suggesting a high-stakes espionage mandate. The inclusion of cloud storage and standard web protocols alongside physical exfiltration indicates a flexible approach to data extraction.
## Mitigations
- Focus on securing highly sensitive networks, particularly ensuring strict control and inspection of removable media used to bridge air-gapped segments.
- Monitor for unusual C2 beaconing via HTTPS, SMTP, or encrypted tunnels (SSH).
- Increased scrutiny of data staging activities in unusual local directories, especially preceding known removable media transfer events.
- Implement strict controls against exfiltration to common cloud storage services like Google Drive from secured networks.