File · GOLD CABIN · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 14 techniques across 5 tactics
Analyst brief
misp-galaxy + mitre-attackGOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads are most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak.
GOLD CABIN infrastructure relies on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.
Kill chain
MITRE ATT&CK Enterprise · tap a technique14 techniques · 5 of 15 tactics
Reconnaissance
1 techniqueInitial access
1 techniqueExecution
2 techniquesStealth
6 techniquesCommand and control
4 techniques
select a technique
Arsenal
4 malware · 1 tools| Tools · 1 | ATT&CK |
|---|---|
| Sliver | S0633 ↗ |
as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
6 sourcesTrack GOLD CABIN on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.