GC01 — APT Profile
From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).Also tracked as
Venom Spider, Golden Chickens, Golden Chickens01, badbullzvenom, badbullz
Tools & malware
- more_eggs backdoor
- Netwire RAT
- Remcos RAT
- Revenge RAT
- Taurus Builder builder/weaponizer
- TerraCrypt ransomware
- TerraLoader loader/dropper
- TerraStealer infostealer
- TerraTV remote-access tool
- VenomLNK loader
Vendor research
- More_eggs served by Venom Spider (Protection Bulletin, 12 May 2025) Symantec (Broadcom)
- More_Eggs malware distributed by Venom Spider threat group (Protection Bulletin, 25 Apr 2022) Symantec (Broadcom)
- Phishing campaign exploits Venom Spider MaaS to deploy RevC2 and Venom Loader (Protection Bulletin, 4 Dec 2024) Symantec (Broadcom)