GOLD EQUINOX

GOLD EQUINOX was a financially motivated crime group that distributed Phobos ransomware. Phobos is likely descended from Dharma, which was operated by the GOLD ORION threat group before its source code was advertised for sale on an underground forum in 2019.
GOLD EQUINOX operated a ransomware-as-a-service (RaaS) scheme, allowing affiliates to gain access to networks and deploy Phobos ransomware. Some Phobos affiliates relied on encryption alone in their operations and did not steal data and hold it to ransom, while others used the ransomware alongside data theft to extort victims. Unusually, unlike most RaaS schemes, GOLD EQUINOX did not run a dedicated leak site for Phobos. Instead, affiliates wishing to run name-and-shame schemes established their own leak sites on which to name victims (e.g. Space Bears or 8BASE). Affiliates customized the file extension used on encrypted files for branding and identification purposes. Phobos deployment has been observed encrypting files with .eight, .elbie and .eking extensions among others.
Affiliates used a variety of tactics, techniques and procedures (TTP) in their operations. These include scanning-and-exploiting to identify and compromise systems, and in many cases CTU researchers have observed, remote desktop protocol (RDP) for access. Encryption-only operators generally used RDP to move laterally once on the network, and deployed the ransomware on individual hosts rather than relying on centralized distribution via group policy objects or active directory domain services. As a consequence, distribution of Phobos ransomware was normally less comprehensive than that of other variants but the dwell time before deployment was short; CTU researchers have observed the encryption of hosts within an hour of gaining initial access. Despite the relatively narrow distribution of the ransomware, such activity could still have a highly damaging impact on business operations.
The operator of Phobos ransomware was extradited to the U.S. in November 2024 and pled guilty to wire fraud charges. In early 2025, the operators of the 8BASE ransomware scheme were arrested and charged in an 11-count indictment. While the Space Bears scheme continued to operate as of March 2026, it is not clear which ransomware variant the group uses in its operations. Makop ransomware, which is derived from Phobos, is still in use, and may be detected as Phobos by some vendors.