GOLD FIESTA

GOLD FIESTA is a financially motivated cybercriminal threat group responsible for the development and deployment of the Hello, Cring, and Rapture ransomware families. The group operates these as traditional ransomware schemes and does not employ name and shame tactics. While there is third-party reporting suggesting that some data is also exfiltrated, the group relies on file encryption as leverage in ransom negotiations.
Active since 2021, GOLD FIESTA establishes initial access to victim networks via opportunistic scanning and exploitation of known vulnerabilities in internet-facing servers. After gaining an initial foothold on a network, GOLD FIESTA typically deploys Cobalt Strike Beacons for command and control. It uses the Cobalt Strike "hashdump" function or Mimikatz to harvest credentials. The group moves laterally across an environment via Cobalt Strike Beacon and SMBExec. GOLD FIESTA attempts to disable the host-based antivirus solution and delete Volume Shadow copies before deploying ransomware to hosts.
CTU researchers assess with moderate confidence that GOLD FIESTA is based in China due to multiple links between the observed tactics, techniques, and procedures (TTPs), and Chinese-language security research.