GoldFactory’s Evolving Identity Fraud Campaigns Intersect with AISURU’s Record-Breaking Botnet Firepower

Group-IB is warning that a financially motivated threat actor it tracks as GoldFactory is scaling up a mobile banking fraud operation across Southeast Asia, in a campaign that directly targets identity verification flows and mobile banking apps. At the same time, Cloudflare has detailed how a separate botnet, AISURU, is driving record-breaking DDoS activity from an estimated one to four million infected hosts, underlining how large-scale botnets and identity-centric fraud are converging risks for financial institutions.

Group-IB’s latest research shows GoldFactory patching legitimate banking apps in Indonesia, Vietnam, and Thailand with malicious code instead of distributing standalone trojan APKs. Investigators identified at least 27 genuine banking applications that had malicious functionality injected and found more than 300 unique samples, with infections linked to at least 30 financial organizations. In total, the firm has tied over 3,000 related malicious artifacts to more than 11,000 infections, mostly in Indonesia, with the true number of impacted banks likely higher due to visibility limits.

The group’s playbook mixes smishing, vishing, and phishing. Victims are approached by phone by callers impersonating government agencies or service providers, then steered to links sent over messaging apps like Zalo. Those links lead to fake app-store pages that deliver modified banking apps which retain normal functionality while hiding injected modules. According to Group-IB, those modules hook into app logic using public frameworks such as Frida, Dobby, and Pine to bypass in-app security controls, conceal accessibility abuse, and gather account balances and other sensitive data, enabling account takeover and high-value fraud.

A new malware lineage dubbed Gigaflower illustrates how closely GoldFactory’s tooling targets identity data. The pre-release test build analyzed by Group-IB supports real-time device streaming, accessibility-driven keylogging and UI scraping, and the ability to present fake system update and PIN screens. It also incorporates text recognition and QR-code scanning aimed at images of national ID cards, suggesting the operators want to automate capture of identity document data used in KYC and remote onboarding. For CISOs, that combination of app tampering, accessibility abuse, and document-level data harvesting means that mobile integrity controls and KYC processes are being attacked as a single fraud surface.

In parallel, Cloudflare’s latest DDoS threat report describes AISURU as one of the most powerful botnets currently in operation, with an estimated one to four million compromised hosts worldwide. In the third quarter of 2025, Cloudflare mitigated 1,304 hyper-volumetric attacks launched by AISURU alone, including a record 29.7 Tbps UDP carpet-bombing attack and a separate 14.1 billion-packets-per-second event. AISURU has primarily targeted telecoms, gaming firms, hosting providers, and financial services, and has been offered as a botnet-for-hire, allowing low-cost on-demand attacks that can overload backbone networks and indirectly disrupt identity and payment services even when they are not the primary target.

For organizations that depend on mobile channels and remote identity proofing, the two reports point to complementary risks. Sophisticated actors are both undermining the trustworthiness of banking apps themselves and renting large-scale DDoS capacity that can knock identity platforms, KYC APIs, or core banking services offline on short notice. Response strategies will need to combine app shielding and runtime integrity checks on mobile devices, stronger controls on accessibility abuse, fraud analytics tuned to hybrid phishing-plus-app-tampering campaigns, and pre-provisioned DDoS mitigation capable of absorbing tens of terabits per second of traffic.

Sources: Cloudflare, Group-IB, The Hacker News

—

By Ji-seo Kim