[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU9f8MN-kWXsnRtJ1s8I6w6m4fvntwsUOvkhNy6TeZjM":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":14,"country":15,"suspected_sponsor":15,"target_industries":16,"target_countries":17,"incident_types":18,"references":19,"techniques":23,"technique_count":24,"created_at":25,"seoMetadata":26,"schemaOrg":30},"GOLD CABIN","gold-cabin",[9,10,11,12,13],"Shakthak","TA551","ATK236","G0127","Monster Libra","GOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads are most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak. GOLD CABIN infrastructure relies on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.",null,[],[],[],[20,21,22],"https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fgold-cabin","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0127\u002F","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fatoms\u002Fmonsterlibra\u002F",[],0,"2023-08-09T17:25:09.409843+00:00",{"title":27,"metaDescription":28,"keywords":29},"GOLD CABIN Threat Actor Profile | EdgeProtect","GOLD CABIN is a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers since 2018. ...","GOLD CABIN, Shakthak, TA551, ATK236, G0127, Monster Libra, threat actor, APT, cyber threat, threat intelligence",{"@context":31,"@type":32,"name":6,"alternateName":33,"description":14,"url":34,"mainEntityOfPage":35},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fgold-cabin",{"@type":36,"@id":34},"WebPage"]