Actor Profile

Golden Chickens (also known as Venom Spider, tracked by Recorded Future as TAG-195) is a financially motivated malware-as-a-service (MaaS) developer that provides tooling to multiple cybercrime groups. The actor operates a commercial MaaS ecosystem, selling access to custom malware families including the well-known More_eggs backdoor. TAG-195's tooling has been used by prominent cybercrime groups including Cobalt Group (Cobalt Gang), Evilnum, and FIN6. The actor is linked to TAG-127, which operates as both a customer and deployer of Golden Chickens malware. Despite extensive public disclosures of their infrastructure and operations, TAG-195 continues active development and refinement of their malware arsenal.

TTPs (Tactics, Techniques, Procedures)

Golden Chickens employs a multi-stage infection chain beginning with social engineering. TAG-127 deploys TinyEgg via ClickFix-style lures that trick users into manually executing malicious commands, downloading OCX payloads from attacker-controlled staging infrastructure (T1204.001 - User Execution: Malicious Link, T1566 - Phishing). TinyEgg provides initial access with anti-analysis capabilities, terminating if sandbox environments are detected (T1497 - Virtualization/Sandbox Evasion). C2 communication uses WebSockets (T1071 - Application Layer Protocol) to facilitate interactive command shells (T1059 - Command and Scripting Interpreter). ChonkyChicken and its modular variant expand capabilities to include credential theft from browsers (T1555.003 - Credentials from Password Stores: Credentials from Web Browsers), live browser session control via Chrome DevTools Protocol, keylogging (T1056.001 - Input Capture: Keylogging), screen capture (T1113 - Screen Capture), clipboard capture (T1115 - Clipboard Data), audio capture (T1123 - Audio Capture), network reconnaissance (T1018 - Remote System Discovery), domain-based reconnaissance (T1087 - Account Discovery), and persistence management (T1547 - Boot or Logon Autostart Execution). The modular architecture allows selective on-demand loading of 14 discrete capability modules from C2 infrastructure.

Targets & Patterns

Golden Chickens operates as a MaaS provider rather than directly targeting specific sectors. The actor's business model involves selling malware tooling to other cybercrime groups who conduct their own targeting operations. Known customers and operators include Cobalt Group, Evilnum, FIN6, and TAG-127, which have historically targeted financial institutions, fintech companies, and organizations across various sectors for financial gain. The MaaS model allows TAG-195 to serve a broad range of operational requirements for diverse customers, with the modular architecture enabling selective provisioning of capabilities based on customer needs. This indirect targeting approach maximizes the actor's revenue potential while limiting their direct exposure to attribution and law enforcement action.

Historical Context

Golden Chickens has been publicly tracked for several years in association with the More_eggs malware family. Previous public disclosures have exposed the group's infrastructure and operational methods, yet TAG-195 has demonstrated resilience by continuing operations and evolving their toolset. The release of four new malware families (TinyEgg, ChonkyChicken, modularized ChonkyChicken, and ChromEggscalator) represents an architectural transition from monolithic to modular implant design. ChromEggscalator is identified as a successor to TerraStealerV2 and is based on a modified version of the publicly available ChromElevator tool. The shift to modular architecture reflects both technical evolution for defense evasion and commercial incentives inherent to the MaaS business model, including the ability to limit exposure if a customer is compromised and provision capabilities selectively to different operators.

Defensive Recommendations

  • Monitor for ClickFix-style social engineering campaigns that prompt users to manually execute commands or download OCX files; implement user awareness training on these tactics (T1204.001)
  • Deploy behavioral detection for WebSocket-based C2 communications from unexpected processes, particularly those establishing persistent shell sessions (T1071)
  • Implement endpoint detection rules for anti-analysis checks and sandbox evasion behaviors, including process termination upon detecting virtualized environments (T1497)
  • Monitor Chrome DevTools Protocol (CDP) usage from non-browser processes and unauthorized browser credential access attempts using tools like Sysmon Event ID 10 for process access to browser processes (T1555.003)
  • Detect modular malware loading patterns by monitoring for processes dynamically requesting and loading multiple discrete capability modules from remote infrastructure, particularly OCX payloads