สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Taurus Loader

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Taurus Loader

Names	Taurus Loader Taurus Builder Taurus Builder Kit
Category	Malware
Type	Botnet, Downloader
Description	(Proofpoint) We use this name to describe a tool used to create malicious documents. We believe Taurus builder was purchased on underground crime forums. Notably, documents created with this builder use the CMSTP bypass.
Information	<https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers> <https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648> <https://quointelligence.eu/2018/11/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using/>

Last change to this tool card: 10 July 2020

Download this tool card in JSON format

Previous: Tarsip
Next: TAXHAUL

All groups using tool Taurus Loader

Changed	Name	Country	Observed
APT groups
	Cobalt Group		2016-Oct 2019
	Venom Spider, Golden Chickens		2017-Jan 2025

2 groups listed (2 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]