[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgviCSjSSW5FBGFn_R9rwrEtNGCZ_N3dhGynKqHg_vBE":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":16,"technique_count":17,"created_at":18,"seoMetadata":19,"schemaOrg":23},"GOFFEE","goffee",[],"GOFFEE is a threat actor that has targeted entities in the Russian Federation since early 2022, employing spear phishing emails with malicious attachments, including modified Owowa and patched explorer.exe. They have utilized PowerTaskel, a non-public Mythic agent in PowerShell, and introduced a new implant called \"PowerModul\" for attacks against sectors such as media, telecommunications, and government. GOFFEE has increasingly shifted to a binary Mythic agent for lateral movement and has incorporated Word documents with malicious VBA scripts in their infection chains. The group has demonstrated a consistent evolution in their TTPs while maintaining identifiable characteristics that attribute their campaigns with high confidence.",null,[],[],[],[15],"https:\u002F\u002Fsecurelist.com\u002Fgoffee-apt-new-attacks\u002F116139\u002F",[],0,"2025-04-19T01:15:05.852388+00:00",{"title":20,"metaDescription":21,"keywords":22},"GOFFEE Threat Actor Profile | EdgeProtect","GOFFEE is a threat actor that has targeted entities in the Russian Federation since early 2022, employing spear phishing emails with malicious attachm...","GOFFEE, threat actor, APT, cyber threat, threat intelligence",{"@context":24,"@type":25,"name":6,"alternateName":26,"description":9,"url":27,"mainEntityOfPage":28},"https:\u002F\u002Fschema.org","Organization",[],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fgoffee",{"@type":29,"@id":27},"WebPage"]