TI Mindmap HUB
Threat Intelligence Report

GoodPerson campaign aimed at users bypassing China’s Great Firewall

📅 October 22, 2026 📰 www.threatlocker.com 🔍 0 CVE(s) referenced

The evolving GoodPerson campaign targets Chinese users seeking banned software such as Chrome, Telegram, and VPNs with trojanized MSI installers that deploy PurpleFox or TerminalControlClient for credential theft, surveillance, persistence, and remote control.

unclassified

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle