{
  "family": "goldun",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nGoldun is a specialized banking trojan and information stealer designed to compromise user accounts across various financial institutions, e-currency platforms, and cryptocurrency exchanges. Operating primarily as a highly stealthy credential harvester, Goldun prioritizes the theft of login data, two-factor authentication (2FA) tokens, and session cookies to facilitate immediate and unauthorized financial transactions.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGoldun is typically distributed through targeted spear-phishing campaigns masquerading as financial alerts, or deployed silently by exploit kits hosted on compromised websites. It is also frequently dropped as a secondary payload by other prevalent trojans.\n\nOnce active, Goldun employs precise, financially-motivated data harvesting techniques:\n<ul>\n<li><strong>Man-in-the-Browser (MitB):</strong> Advanced variants of Goldun inject malicious code directly into web browsers (API hooking) to intercept data before it is encrypted via HTTPS. This allows the attacker to capture banking passwords and PINs in plaintext.</li>\n<li><strong>Web Injects:</strong> It can dynamically alter the HTML of legitimate banking websites displayed to the victim, prompting them to enter additional sensitive information (like ATM PINs, Social Security numbers, or answers to security questions) which is then exfiltrated.</li>\n<li><strong>Credential Store Extraction:</strong> The trojan systematically extracts saved passwords, cookies, and session tokens directly from the local credential stores of popular web browsers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Goldun infection is a critical security incident prioritizing immediate financial fraud. The theft of session cookies and 2FA tokens can allow attackers to bypass standard security measures and drain corporate or personal bank accounts directly.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to isolate the endpoint to halt the active exfiltration of captured credentials and network traffic logs.</li>\n<li><strong>Immediate Financial Notification:</strong> Contact associated financial institutions immediately to freeze accounts and monitor for unauthorized transactions.</li>\n<li><strong>Global Credential Reset:</strong> A mandatory, global reset of all associated credentials (including MFA tokens) is absolutely required.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the deep system hooking required for Man-in-the-Browser attacks, the endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Goldun",
    "Banker.Goldun",
    "Win32/Spy.Goldun"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.004",
    "T1552.001",
    "T1114"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:07:00Z",
  "type": "Banking Trojan / Info Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}