GOLD MANSARD

GOLD MANSARD was a financially motivated cybercriminal threat group that operated the Nemty and Nefilim ransomware. The threat actor behind Nemty was known on Russian underground forums as "jsworm". Nemty was operated as a ransomware as a service (RaaS) affiliate program and featured a "name and shame" website where exfiltrated victim data was leaked. In April 2020, jsworm appeared to acquire new partners and retired the Nemty ransomware. This was followed by the introduction of Nefilim ransomware, which did not operate as an affiliate model. Nefilim was used in post-intrusion ransomware attacks against organizations in logistics, telecommunications, energy and other sectors for nearly a year and a half before they stopped in mid-2021. SentinelOne reported that Karma ransomware, which operated for just one month after the last victim was named on the Nefilim leak site, may be a derivative of Nemty. Nokoyawa ransomware, which named a handful of victims over a six-month period in 2023, may also have been linked to GOLD MANSARD operations. However, CTU researchers are unable to independently verify these claims.
GOLD MANSARD exploited vulnerabilities in internet-facing devices and services such as Citrix and Remote Desktop Protocol for initial access. The group escalated privileges and used tools common to other post-intrusion ransomware threat groups including Mimikatz for credential theft, AdFind for Active Directory enumeration, Cobalt Strike for post-exploitation activities and lateral movement, and MegaSync for data exfiltration.