toolkit
GOCLOUD
Named by 1 report, 7 detection rules, 0 IOC feeds and 1 tracked actor.
Also written as: GOCLOUD and OmniHunter toolkit, OmniHunter. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
GOCLOUD Multi-Service Cryptojacking
GOCLOUD_Windows_Deploy_Worm_Lingkai, GOCLOUD_Windows_Miner_WinJenkins, GOCLOUD_Linux_Miner_v7, GOCLOUD_BatchExploit_Dispatcher, GOCLOUD_OmniHunter_v4_Orchestrator, GOCLOUD_Listener2_Control_Plane, GOCLOUD_LAN_Probe_Attack_Banner
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-020: Self-branded commodity cryptojacking operator mass-exploiting exposed Chinese enterprise software
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.