GoldFactory Ransomware Decryption & Data Recovery

The headline first: GoldFactory is not a ransomware family. It is a financially motivated, Chinese-speaking mobile crime group named publicly by Group-IB in February 2024. Its earliest core tool, Gigabud, dates to 2022, and the group's activity at scale began in mid-2023. The entry is kept in this family library because "my phone was taken over and money disappeared" is often described loosely as an infection or an extortion case, while the response window and the available countermeasures are nothing like those of an encryption incident.

Tooling lineage. GoldDigger (October 2023, against 50-plus Vietnamese financial institutions), GoldDiggerPlus with its embedded GoldKefu module and live voice operators, GoldPickaxe (October 2023 - the first known iOS trojan to harvest facial biometrics), the continuously developed Gigabud and its reworked test branch Gigaflower, and the companion cloner Vwork disclosed in September 2026. The group also uses Remo and MMRat as droppers and tampers with legitimate banking apps using Frida, Dobby and Pine, which Group-IB tracks as FriHook, SkyHook and PineHook.

Scale and geography. Group-IB's December 2025 report traced modified banking apps back to Thailand in October 2024, then Vietnam across late 2024 and early 2025, with a sharp rise in Indonesia from mid-2025: 300-plus modified app samples, 27 legitimate banking apps injected, 30 targeted financial institutions, more than 3,000 related samples and over 11,000 infections. The September 2026 Vwork report adds that Gigabud samples compatible with the cloner also target Brazil, Colombia, Egypt, Laos, Mexico, Morocco, the Philippines and Türkiye. No public reporting shows campaigns against mainland China financial institutions, but Chinese security vendors track the group in their financial-sector monthly reporting, and outbound business units and staff handsets used across borders remain inside its reach.

There is no extension and no ransom note here, so attribution rests entirely on device-side indicators:

• Unusual install origin. The app arrives from a phishing page or a messenger link as an APK rather than from a store. Early iOS victims were pushed through TestFlight or talked into installing an MDM profile; since late 2025 the group has largely abandoned custom iOS malware and instead instructs victims by phone to "borrow an Android handset".
• A suspicious permission bundle. Accessibility, draw-over-other-apps, screen capture, camera, SMS and contacts requested together, plus an exemption from battery optimisation. Granting Accessibility is the moment the operator gains live control of the device.
• Interface anomalies. A fake login page appearing on top of the real banking app, an invisible overlay capturing the lock-screen code, and a black screen or "system update" panel shown while transfers are executed.
• An unexpected work profile. A Work tab under Settings, passwords and accounts, briefcase badges on app icons, or the same banking app present in both the personal and work spaces - the signature of Vwork cloning.
• Other technical markers. Apps with no launcher icon, encrypted payload files such as payload_dex.bin and dex_key.bin, and a SOCKS5 listener bound to 127.0.0.1.

Inverse test. If files genuinely carry a new extension and a note has been written to disk, this is not the family in question; re-identify against the relevant encryption family instead of applying the assumptions on this page.

The entry point is social engineering, not exploitation, and the whole chain is driven by human operators:

• Impersonating government and public services. Vietnamese cases impersonated EVN over "overdue electricity bills", provincial health departments announcing food-safety inspections, the national public service portal and the Ministry of Public Security. Indonesian cases impersonated Disdukcapil, the civil registration authority, using the national rollout of the digital KTP identity card to push a fake "IKD" app. Airline and tax-authority lures also appear.
• A phone call plus a messenger. A call first, manufacturing urgency (disconnection, a fine, an administrative penalty), then a move to Zalo or a similar app where a "support agent" walks the victim through download and permissions. The GoldKefu module even embeds live voice operators who can talk to the victim in real time.
• Fake app stores. Pages closely imitating Google Play that deliver an APK; when the store install "fails" or reports the app as "incompatible", the victim is redirected to sideload from an external site.
• Chinese-language bait. The July 2026 variant was distributed through a spoofed KuaiBo streaming site, showing the lures are no longer limited to government themes.

For enterprises the transmission path that matters is the employee's personal handset - the same device typically carries corporate OA, mail, VPN tokens and banking apps, so one successful consumer-side social-engineering attempt can carry corporate credentials away with it.

There is no encryption. The question worth asking in this section is a different one: what do these trojans take, and how do they get past the bank's controls?

• Collection targets. Facial recognition video and stills, ID card photographs, SMS and one-time codes, banking credentials, the device lock code, the full installed-app list (used to pick high-value banking targets), and live screen content read through Accessibility.
• Defeating liveness checks. Stolen face material is run through AI face-swapping to produce deepfake video, which is injected into the banking app's capture pipeline using virtual camera software and hooking frameworks such as Frida and LSPosed. Because liveness verification checks the frame presented rather than its source, injection defeats even fairly mature detection.
• Defeating bank-side fraud controls (the 2026 technique). After gaining permissions, Gigabud installs Vwork, a weaponised fork of the open-source cloner Shelter, which uses the Android Work Profile feature to create an isolated space, clones the banking app into it and transacts from there. A malware alert already raised in the personal profile does not fire again in the freshly provisioned work profile, so the bank sees an ordinary transaction from a "new device" and the link between the malicious signal and the fraudulent transfer is deliberately severed.
• Measured impact. Group-IB observed roughly 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia alone between February and July 2026, with estimated losses of about USD 960,000.