Threadlinqs IntelligenceStart free

Threat actorCNTracked since 2026-09

GoldFactory

As of 2026-10-21, GoldFactory is a CN-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning malware. ATT&CK coverage spans 23 techniques across 13 tactics in 2 of 2 tracked threats. Most-observed techniques: T1417.001 (Keylogging), T1417.002 (GUI Input Capture), T1513 (Screen Capture).

Tracked threats
22 high
First seen
2026-09-11
Last seen
2026-10-21
ATT&CK techniques
23across 2 of 2 threats
Related CVEs
0None referenced
Attribution
CNNation or origin
Nation: CN · 2 tracked threat(s) · Categories: MALWARE

Activity timeline

GoldFactory appears in 2 tracked threats between and ; the busiest month was 2026-09 with 1 report.

ATT&CK techniques observed

23 techniques observed across 2 of 2 tracked threats · Defense Evasion (Mobile) (7), Collection (3), Collection (Mobile) (2), Command and Control (Mobile) (2), Lateral Movement (Mobile) (2), Resource Development (2)
  • T1417.001 Keylogging — Collection (Mobile)observed in 2 of 2 tracked threats
  • T1417.002 GUI Input Capture — Credential Access (Mobile)observed in 2 of 2 tracked threats
  • T1513 Screen Capture — Collectionobserved in 2 of 2 tracked threats
  • T1516 Input Injection — Defense Evasion (Mobile)observed in 2 of 2 tracked threats
  • T1660 Phishing — Initial Access (Mobile)observed in 2 of 2 tracked threats
  • T1406.002 Software Packing — Defense Evasion (Mobile)observed in 1 of 2 tracked threats
  • T1418 Software Discovery — Lateral Movement (Mobile)observed in 1 of 2 tracked threats
  • T1420 File and Directory Discovery — Lateral Movement (Mobile)observed in 1 of 2 tracked threats
  • T1426 System Information Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1437.001 Application Layer Protocol: Web Protocols — Command and Control (Mobile)observed in 1 of 2 tracked threats
  • T1481 Web Service — Command and Control (Mobile)observed in 1 of 2 tracked threats
  • T1512 Video Capture — Collectionobserved in 1 of 2 tracked threats
  • T1566.003 Phishing: Spearphishing via Service — Initial Accessobserved in 1 of 2 tracked threats
  • T1575 Native API — Executionobserved in 1 of 2 tracked threats
  • T1583.001 Domains — Resource Developmentobserved in 1 of 2 tracked threats

Tracked threats