Meta tags:

Headings (most frequently used words):

goldfinder, techniques, used, groups, that, use, this, software, campaigns, references, enterprise, layer,

Text of the page (most frequently used words):
2021 (12), att (11), and (11), all (10), the (9), enterprise (9), #goldfinder (9), retrieved (7), http (7), april (6), ics (5), mobile (5), none (5), software (5), mitre (4), data (4), techniques (4), march (4), version (4), use (3), campaigns (3), groups (3), cti (3), defenses (3), apt29 (3), for (3), solarwinds (3), compromise (3), name (3), that (3), discovery (3), used (3), 2026 (2), corporation (2), are (2), domains (2), resources (2), reference (2), components (2), analytics (2), detection (2), strategies (2), assets (2), mitigations (2), tactics (2), matrices (2), core (2), objects (2), 2022 (2), russian (2), into (2), ncsc (2), nsa (2), fbi (2), svr (2), may (2), nobelium (2), early (2), with (2), actors (2), references (2), get (2), internet (2), other (2), network (2), 001 (2), related (2), route (2), packet (2), from (2), compromised (2), server (2), including (2), response (2), layer (2), malware (2), s0597 (2), can (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, sub, mandiant, assembling, nesting, doll, unc2452, merged, 2023, call, out, russia, dhs, targets, allied, networks, secureworks, ctu, iron, ritual, february, mstic, breaking, down, latest, stage, toolset, august, cisa, further, ttps, associated, cyber, july, nafisi, lelli, goldmax, sibot, analyzing, layered, persistence, c0024, description, g0016, this, performed, requests, check, connectivity, identify, proxy, servers, redirectors, request, traveled, through, connection, system, configuration, t1016, logged, stored, information, hops, took, machine, hardcoded, target, url, status, code, headers, values, received, node, automated, collection, t1119, has, web, protocols, application, protocol, t1071, domain, view, download, navigator, layers, live, permalink, 2025, last, modified, created, windows, platforms, type, custom, tracer, tool, written, logs, takes, between, inform, threat, potential, points, logging, their, actions, was, discovered, during, investigation, home, open, join, october, mclean, hotel, location, details, found, register, here, search, blog, contribute, benefactors, legal, branding, updates, history, engage, tools, advisory, council, learn, more, about, started, detections,

Text of the page (random words):
goldfinder software s0597 mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq home software goldfinder goldfinder goldfinder is a custom http tracer tool written in go that logs the route a packet takes between a compromised network and a c2 server it can be used to inform threat actors of potential points of discovery or logging of their actions including c2 related to other malware goldfinder was discovered in early 2021 during an investigation into the solarwinds compromise by apt29 1 id s0597 ⓘ type malware ⓘ platforms windows version 1 1 created 26 march 2021 last modified 16 april 2025 version permalink live version att ck navigator layers enterprise layer download view techniques used domain id name use enterprise t1071 001 application layer protocol web protocols goldfinder has used http for c2 1 enterprise t1119 automated collection goldfinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded c2 server including the target c2 url http response status code http response headers and values and data received from the c2 node 1 enterprise t1016 001 system network configuration discovery internet connection discovery goldfinder performed http get requests to check internet connectivity and identify http proxy servers and other redirectors that an http request traveled through 1 groups that use this software id name references g0016 apt29 1 2 3 4 5 6 7 campaigns id name description c0024 solarwinds compromise 1 references nafisi r lelli a 2021 march 4 goldmax goldfinder and sibot analyzing nobelium s layered persistence retrieved march 8 2021 ncsc cisa fbi nsa 2021 may 7 further ttps associated with svr cyber actors retrieved july 29 2021 mstic 2021 may 28 breaking down nobelium s latest early stage toolset retrieved august 4 2021 secureworks ctu n d iron ritual retrieved february 24 2022 nsa fbi dhs 2021 april 15 russian svr targets u s and allied networks retrieved april 16 2021 uk ncsc 2021 april 15 uk and us call out russia for solarwinds compromise retrieved april 16 2021 mandiant 2022 april 27 assembling the russian nesting doll unc2452 merged into apt29 retrieved march 26 2023 core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation