Ankura CTIX FLASH Update - February 16, 2024

Ransomware/Malware Activity

GoldPickaxe Trojan Leveraged as Facial Recognition Stealer for Future Attacks

A new trojan for iOS and Android has been discovered that uses its capabilities to scan the victim's face for apparent use in future deepfakes. The trojan, named "GoldPickaxe", is the latest strain of malware developed by the Chinese threat actor group "GoldFactory", seen targeting users in Southeast Asia. Victims are initially contacted via the LINE instant messaging application by threat actors pretending to be from their respective government. The threat actor then attempts to convince the victim to download a fake pension application from a webpage designed to impersonate the Google Play Store. For iOS users, the threat actor takes a more roundabout approach, attempting to get the user to download a Mobile Device Management (MDM) profile that then downloads the application from a website. This method allows the threat actor to have a great deal of access