GOLD CABIN

GOLD CABIN was a financially motivated cybercriminal threat group operating a malware distribution service on behalf of numerous customers from early 2018 through 2022. GOLD CABIN used malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads were most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak. GOLD CABIN infrastructure relied on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.
In October 2022 a Russian national named Ilya Angelov, who was accused of being the principal operator of GOLD CABIN, was detained and subsequently extradited to the United States. In March 2026, Angelov was sentenced to 24 months of incarceration for his involvement in the criminal enterprise.