GOLD GALLEON

Executive Summary

GOLD GALLEON is a financially motivated cybercriminal group targeting maritime organizations through business email compromise (BEC) and spoofing campaigns. They have demonstrated significant activity across multiple countries, including South Korea, Japan, Singapore, Norway, and the U.S., among others. The group leverages commodity malware and tools similar to other BEC groups, such as GOLD SKYLINE, indicating a focus on cost-effective yet effective operational tradecraft.

Goals & Targeting

GOLD GALLEON's strategic objectives appear to center on financial gain through fraudulent activities. Their targeting of maritime organizations suggests a focus on industries with significant financial transactions and global supply chains. This approach allows them to maximize their return on investment by exploiting the trust relationships within these sectors. The group's international reach indicates a potential intent to diversify victim bases, reducing detection risk while maintaining profitability.

GOLD GALLEON operates as a cybercriminal collective comprised of numerous associates targeting maritime sectors globally. Their primary modus operandi involves BEC and BES (Business Email Spoofing) campaigns, which are designed to deceive victims into transferring sensitive information or funds. CTU researchers have observed the group's activity across various regions, including South Korea, Japan, Singapore, Philippines, Norway, U.S., Egypt, Saudi Arabia, and Colombia, suggesting a well-coordinated international reach. The threat actors' use of publicly available tools and malware, such as remote access trojans and crypters, indicates a focus on cost-effective solutions rather than developing sophisticated custom tools. Despite this, their operational success demonstrates an understanding of target sectors' vulnerabilities, particularly in the maritime industry, where high-value transactions make BEC attacks lucrative.

Key Capabilities

• Business Email Compromise (BEC)
• Email Spoofing
• Use of commodity malware and remote access trojans
• Spoofing attacks targeting maritime organizations
• Leverage publicly available tools for campaigns

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GOLD GALLEON's campaigns are characterized by their use of BEC and BES tactics, often involving well-crafted email lures and domain spoofing. Their operational tempo appears steady, with sustained activity across multiple geographies. Notable past operations include numerous successful fund transfers from maritime organizations to fraudulent accounts, leveraging the trust established within these sectors. The group's ability to adapt their targeting while maintaining a focus on cost-effective tools underscores their effectiveness as a financially motivated threat actor.

IOC Patterns

• Spear-phishing emails with urgent payment requests
• Email spoofing using domains mimicking legitimate companies
• Use of compromised accounts for fraudulent wire transfers
• Leverage cheap and readily available malware-as-a-service (MaaS) offerings

Recommended Actions

• Implement stricter email authentication protocols (e.g., DKIM, SPF, DMARC)
• Educate employees on identifying BEC and BES attempts
• Enhance fraud detection mechanisms for wire transfers
• Conduct regular security audits of maritime supply chain partners
• Monitor for异常交易 patterns in financial systems

Suggested Tags