.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Summary
GOLD HIDEAWAY was a financially motivated crime group that had been active since June 2021. It acted as an affiliate in ransomware operations, and had been observed delivering LockBit and conducting precursor activity to a REvil deployment.
The group used search engine optimization poisoning (SEO) to direct victims to compromised WordPress websites hosting malicious Javascript files in ZIP archives. Opening the Javascript files started an infection chain resulting in the installation of Cobalt Strike Beacon. A similar method had been observed in Gootkit deployments.
In addition to Cobalt Strike, GOLD HIDEAWAY used Advanced IP scanner for reconnaissance, Free Files Sync for data exfiltration and attempted defense evasion by disabling anti-virus services before deploying ransomware.
CTU researchers assess with moderate confidence that GOLD HIDEAWAY had begun working with GOLD MYSTIC to deploy LockBit ransomware in response to GOLD SOUTHFIELD temporarily shuttering its REvil operation in July 2021.
The group used search engine optimization poisoning (SEO) to direct victims to compromised WordPress websites hosting malicious Javascript files in ZIP archives. Opening the Javascript files started an infection chain resulting in the installation of Cobalt Strike Beacon. A similar method had been observed in Gootkit deployments.
In addition to Cobalt Strike, GOLD HIDEAWAY used Advanced IP scanner for reconnaissance, Free Files Sync for data exfiltration and attempted defense evasion by disabling anti-virus services before deploying ransomware.
CTU researchers assess with moderate confidence that GOLD HIDEAWAY had begun working with GOLD MYSTIC to deploy LockBit ransomware in response to GOLD SOUTHFIELD temporarily shuttering its REvil operation in July 2021.
Contact us
Contact us directly whether your organization needs immediate assistance or
you want to discuss your incident readiness, response, and testing needs.