GOLD IONIC

GOLD IONIC is a financially motivated cybercriminal threat group that operates the INC Ransom ransomware, using a dedicated leak site to name the victims of their extortion and ransomware operations. The group emerged in July 2023, and since then have listed victim names on their leak site at an average of around 10 a month. GOLD IONIC operates a double extortion model, first stealing victim data and then encrypting systems, demanding payment for decryption keys and threatening to leak the data online should the victim fail to comply with their demands. While it is not clear that GOLD IONIC operates an affiliate model, the group has posted victims of other ransomware groups, specifically ALPHV/BlackCat, to its leak site. This may have been due to the law enforcement action that rendered the ALPHV/BlackCat site inaccessible, forcing affiliates to looks elsewhere for accommodating groups to assist them with posting victim data.
GOLD IONIC uses compromised credentials to gain access to a victim environment and moves laterally using RDP (Remote Desktop Protocol). Third-party researchers have also observed the group exploiting the 'Citrix Bleed' vulnerability (CVE-2023-3519). CTU researchers have seen GOLD IONIC using Metasploit and PsExec, as well as MegaSync, for the exfiltration of data from victim networks. GOLD IONIC also use a range of other commercial-off-the-shelf tools and LOLBins once inside a victim network for discovery and lateral movement.
GOLD IONIC encrypts victim files, adding the .INC extension, and drops both .txt and .html ransom notes with the file name INC-README. GOLD IONIC has also been observed using network-connected printers to print out physical copies of the ransom notes in the victim environment. These ransom notes contain a unique link for each victim, which directs them towards a Tor-hosted payment portal.