Poisoned Pipeline / Incidents / AS326
GoldenSpy backdoor shipped inside bank-mandated tax software
Windows softwareInstaller / update channel
Trustwave SpiderLabs documented GoldenSpy (also tracked as S0493): a
backdoor embedded in a tax-invoicing package that a Chinese bank
required its foreign corporate clients to install in order to pay
Chinese taxes. The software installed a remote-access implant alongside
the legitimate function, and a second component was later pushed to
already-installed copies. The delivery mechanism is the relationship
rather than a compromised repository: the customer installs the product
because a business counterparty requires it, and the supplier of that
software is the bank or its vendor.
Mapped techniques
supply-chain Bank-mandated tax software
The installer is supplied by a business partner as a condition
of doing business, so the normal vendor-selection control never
applies.
A backdoor shipped inside the package from the outset, with a
follow-on component pushed to existing installs.
Framework gaps noted
- The corpus has no technique for coerced installation by a business counterparty. T0197 is the nearest fit and understates the pressure.