GOLD WYMAN

CTU researchers attributed a November 2017 theft campaign reported by Kaspersky that targeted banks in Russia, Armenia and Malaysia to the GOLD WYMAN threat group. The attack was similar to historical GOLD LOCUST (Carbanak) activity in that it used spearphishes to target specific bank employees and deployed the Silence trojan. This included screen recording functionality to monitor the employees' activities. After sufficient information was obtained, the criminals conducted large transfers to steal funds.