Actor Profile

Golden Chickens (also known as Venom Spider, tracked by Recorded Future as TAG-195) is a financially motivated malware-as-a-service (MaaS) developer that provides tooling to multiple cybercrime operators. The group has historically supplied malware families including More_eggs to prominent threat actors such as Cobalt Group (Cobalt Gang), Evilnum, and FIN6. TAG-195 operates as a commercial MaaS provider, with TAG-127 identified as a known operator and customer. Despite extensive public disclosures of their infrastructure and operations, the group continues active development and has demonstrated resilience by releasing four new malware families with architectural improvements focused on modularity and defense evasion.

TTPs (Tactics, Techniques, Procedures)

The Golden Chickens ecosystem demonstrates sophisticated TTPs centered on initial access via social engineering (ClickFix/VenomLNK campaigns tricking users into executing malicious commands), followed by deployment of OCX payloads. TinyEgg provides initial access with anti-sandbox detection, host profiling, and WebSocket-based C2 communication for interactive shell access. ChonkyChicken delivers full-featured post-exploitation capabilities including browser credential theft via Chrome DevTools Protocol (CDP), credential-backed remote execution, and network reconnaissance. The modular ChonkyChicken variant employs a controller-plugin architecture with 14 discrete capability modules (process management, screen capture, file manipulation, keylogging, audio capture, clipboard capture, domain reconnaissance, HTTP/S requests, and persistence management). ChromEggscalator (successor to TerraStealerV2) bypasses Chrome encryption for credential theft. The modular architecture reduces static detection exposure and enables selective capability provisioning to MaaS customers.

Targets & Patterns

Golden Chickens operates as a MaaS provider rather than directly targeting specific sectors. The group's tooling is leveraged by multiple cybercrime operators including Cobalt Group, Evilnum, and FIN6, who historically target financial institutions and other high-value sectors. TAG-127, a known customer, deploys Golden Chickens malware via ClickFix-style social engineering campaigns targeting unsuspecting users across various sectors. The modular architecture and selective capability provisioning model suggests the MaaS is designed to serve diverse operational requirements for multiple customers with varying targeting objectives, from credential theft and surveillance to network reconnaissance and persistent access.

Historical Context

Golden Chickens has been publicly associated with the More_eggs malware family and has supplied tooling to established cybercrime groups including Cobalt Group (Cobalt Gang), Evilnum, and FIN6 over multiple years. The group has previously faced extensive public disclosures of their infrastructure and operations, yet continues to operate and evolve. The latest campaign represents an architectural transition from monolithic malware to modular implants, with ChromEggscalator serving as a successor to the previously disclosed TerraStealerV2 credential stealer. TAG-127 has been observed as both an operator and customer of TAG-195 tooling. The shift to modular architecture reflects both technical evolution and commercial adaptation within the MaaS model, enabling better OPSEC and customer segmentation following prior exposure.

Defensive Recommendations

  • Monitor for ClickFix-style social engineering campaigns that prompt users to manually execute commands or download OCX payloads from external infrastructure
  • Implement WebSocket traffic inspection and behavioral monitoring for unusual C2 communication patterns, particularly interactive shell sessions over WebSocket protocols
  • Deploy Chrome DevTools Protocol (CDP) monitoring to detect unauthorized browser session control and credential theft attempts via CDP abuse
  • Enable enhanced logging for OCX file execution and implement application whitelisting to prevent execution of unsigned or suspicious OCX payloads
  • Detect anti-sandbox evasion techniques through detonation in varied analysis environments and monitor for malware that terminates upon detecting virtualization artifacts
  • Implement modular malware detection by monitoring for on-demand component downloads from C2 infrastructure and unusual plugin-loading behaviors