GOFFEE

Executive Summary

GOFFEE—also known as APT28/Fancy Bear—is a highly sophisticated threat actor that has targeted Russian and numerous global organizations since early 2022. Employing spear‑phishing, webmail XSS exploits, zero‑day CVEs, and custom Mythic‑based implants (PowerTaskel, PowerModul), the group achieves persistence, lateral movement, and data exfiltration across sectors including government, defense, finance, and telecommunications.

Goals & Targeting

The actor’s strategic objectives combine state‑level intelligence gathering with financial exploitation. GOFFEE targets critical infrastructure, defense contractors, finance, telecommunications, and manufacturing firms worldwide, focusing on organizations in Russia, Ukraine, the United States, China, and other technologically relevant states. By compromising high‑value accounts (VPN, web browsers), they extract privileged credentials, exfiltrate sensitive data, and sometimes monetize through ransomware or sell stolen information. Beyond espionage, GOFFEE’s campaigns are known for their persistence in delivering payloads and maintaining long‑term footholds via Mythic‑based agents. Their focus on sectors that store proprietary research and supply‑chain details suggests a dual motive: direct financial gain from data resale and strategic intelligence benefits to adversary governments. GOFFEE employs a multi‑layered approach—phishing, webmail exploitation, zero‑day CVEs—to ensure high success rates, enabling them to pivot quickly between initial compromise, lateral movement, and exfiltration across diverse industry targets.

Key Capabilities

• Spear‑phishing with embedded XSS payloads targeting webmail clients
• Exploitation of webmail client vulnerabilities (Horde, MDaemon, Zimbra, Roundcube)
• Zero‑day exploitation of widely used software (e.g., CVE‑2024‑11182, WinRAR CVEs)
• Malicious JavaScript execution for email and contact harvesting
• Deployment of custom backdoors and web shells (Havoc, HanifNet, MeshCentral Agent, SystemBC)
• Remote code execution via Ivanti EPMM and other CVEs
• Reflective Java payloads for in‑memory command execution
• Extraction of hard‑coded MySQL credentials for lateral movement
• Use of Fast Reverse Proxy and Auto‑Color Linux backdoor to maintain persistence
• Utilization of legitimate Windows tools (iediagcmd.exe) for delivery
• Delivery of custom implants via WebDAV or compressed archives
• Phishing with spoofed emails and malicious attachments
• .NET assemblies and in‑memory payload deployment
• Targeted attacks against defense, finance, manufacturing, logistics companies

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GOFFEE’s operations exhibit a rapid evolution in tactics and tools, with a clear preference for combining spear‑phishing, zero‑day exploits, and custom Mythic implants. The actor demonstrates an operational tempo that allows swift pivoting between high‑impact corporate targets and strategic defense firms across multiple continents. Frequent use of webmail XSS and WebDAV exploitation points to a well‑understood vector against enterprises with legacy or poorly patched mail infrastructures. Past campaigns—including the paper‑werewolf operation against Ukrainian firms and the Stealth Falcon assaults on Turkish defense—highlight GOFFEE’s ability to maintain persistence over months, leveraging encrypted C2 channels (Globe, Horus, Mythic) for data exfiltration. The group’s breadth of victim industries and continued innovation in payload delivery (reflection, VBA macros, WinRAR abuse) signals an ongoing threat of both espionage and financial theft.

IOC Patterns

• CVE identifiers
• XSS payloads detected in webmail client HTML
• Phishing email subjects with political or sensational content
• Web shell deployments on publicly accessible servers
• Credential harvesting from VPN/SSL certificates
• Compressed RAR archives disguised as legitimate documents
• Spoofed sender addresses impersonating partner companies
• Hash‑sha256 values for malicious binaries
• Malicious file names targeting executables (e.g., H5GDXM70NJ.exe)
• Domain indicators linked to command and control or dropper hosts
• Email indicators of phishing campaigns

Recommended Actions

• Apply vendor patches immediately for known CVEs (CVE‑2024‑11182, CVE‑2025‑33053, CVE‑2025‑8088, CVE‑2025‑6218).
• Disable or strictly filter XSS in webmail applications and enforce strict MIME validation.
• Deploy advanced email security solutions to detect spear‑phishing with malicious attachments and spoofed domains.
• Block outbound traffic to known C2 IP ranges and monitor anomalous exfiltration attempts via encrypted tunnels.
• Implement host‑based intrusion detection to flag the presence of Mythic agents, PowerTaskel, or PowerModul implants.
• Segment networks and enforce least privilege to limit lateral movement from compromised accounts.
• Use anti‑exploit solutions to detect reflective Java payloads and process injection attempts (T1055).
• Enable logging of registry modifications (T1547.001) and monitor suspicious use of legitimate tools like iediagcmd.exe or rundll32 calls.
• Conduct regular security awareness training focused on phishing, VBA macro abuse, and WebDAV exploitation.

Suggested Tags