GoldenJackal Silently Targets Middle East & South Asia Government Entities

A newly discovered Advanced Persistent Threat (APT) group named ‘GoldenJackal’, known to be active since 2019, has been stealthily targeting government and diplomatic organizations in the Middle East & South Asia, reports Kaspersky.

The Russian cybersecurity firm has been monitoring the group’s activity since mid-2020 and has noticed the group targeting a few entities in countries like Afghanistan, Azerbaijan, Iran, Iraq, Pakistan, and Turkey. This modus operandi has helped the threat actor remain relatively obscure.

The group’s primary focus being collecting government secrets & information, GoldenJackal employs a specific set of malware tools to control the victim’s devices, steal credentials, user’s web activity information, capture screenshots, access other systems via removable devices and data theft.

Kaspersky notes that the threat actor has been observed using fake Skype installers and malicious Word documents as its attacking tool. The fake Skype installer contains two resources – the JackalControl Trojan and a legitimate Skype for Business standalone installer. While spreading malware, the malicious Word document makes use of the Microsoft Office Follina vulnerability (CVE-2022-30190).

Based on a specific .Net malware, the attack vectors primarily consist of JackalControl. The primary trojan, JackControl allows the APT to remotely control the victim’s devices with a supported set of predefined commands. The malware can execute arbitrary programs as well as upload and download files.

Over the years, Kaspersky has discovered different variants of this malware, some are configured to maintain persistence while others run without infecting the system. Some of the other variants of this malware deployed by GoldenJackal include JackSteal, JackWorm, JackPerInfo and JackalScreenWatcher.

Based on Kaspersky’s observations, GoldenJackal does not have any link with any known threat actor. The closest actor that the cybersecurity firm associates it with is ‘Turla’ because both have been known to use tools based on .Net and usage of infected WordPress websites as C2. However, Kaspersky’s Giampaolo also states that, ‘’ Despite these similarities, we assessed with low confidence that there is a connection between GoldenJackal and Turla, since neither of these is unique to either threat actor’’.