Currently, there’s limited public information on this Masked Actors group. However, in May 2024, we uncovered the first iOS trojan, dubbed GoldPickaxe.iOS. Part of a sophisticated suite of mobile banking malware, this trojan harvests facial recognition data for unauthorized access to bank accounts using deep fakes — introducing a new monetary theft technique previously unseen. This threat cluster has been attributed to a single actor, codenamed: GoldFactory.
Tend to be finance companies, predominantly in the Asia-Pacific (APAC) region, with evidence suggesting a strong focus on Vietnam and Thailand firms.
There are indications GoldFactory will expand its operations beyond its two target countries.
