{
  "family": "golem",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nGolem is a sophisticated malicious Trojan and rootkit designed to covertly infiltrate Windows systems, establish deep persistence, and recruit the compromised endpoint into a botnet. Historically, \"Golem\" variants have been utilized by advanced threat actors to facilitate massive Distributed Denial of Service (DDoS) attacks, relay spam, or serve as a persistent backdoor for secondary payload delivery.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nGolem is typically distributed via exploit kits that silently compromise vulnerable web browsers, through massive spear-phishing campaigns, or by brute-forcing weak RDP (Remote Desktop Protocol) credentials.\n\nOnce executed, Golem focuses on stealth and network control:\n<ul>\n<li><strong>Kernel-Level Rootkit:</strong> Advanced variants of Golem utilize kernel-mode drivers (rootkits) to intercept API calls. This allows the malware to completely hide its processes, files, and registry entries from the Windows Task Manager and traditional, user-mode antivirus scanners.</li>\n<li><strong>Botnet Recruitment:</strong> The primary function is to connect the endpoint to a centralized Command and Control (C2) server. The machine then quietly awaits instructions, allowing the attacker to utilize the collective processing power and bandwidth of thousands of infected machines simultaneously.</li>\n<li><strong>Secondary Payloads:</strong> Because Golem establishes a highly secure, hidden backdoor, the botnet operators frequently lease access to the infected machines to other criminal groups, who then utilize the Golem backdoor to deploy ransomware or info-stealers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Golem detection is a critical security incident. The presence of a rootkit implies that the operating system itself can no longer be trusted to accurately report its own state. The endpoint is actively contributing to malicious activity on the internet and is highly vulnerable to the deployment of secondary, destructive payloads.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> The highest priority is to sever the connection to the C2 server by instantly isolating the infected endpoint from the LAN and the internet.</li>\n<li><strong>Memory Forensics and Offline Scanning:</strong> Because the rootkit hides the malware from the running OS, analysis and detection often require memory forensics (e.g., Volatility) or booting the machine from an offline, trusted OS (like a Linux Live USB) to scan the dormant hard drive.</li>\n<li><strong>Complete Re-imaging:</strong> Due to the kernel-level hooks established by the rootkit, attempting to \"clean\" the system is highly unreliable. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Golem",
    "Rootkit.Golem",
    "Botnet.Golem",
    "Win32/Golem"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1014",
    "T1055",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:25:05Z",
  "type": "Trojan / Rootkit / Botnet",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}