GOLD OLDFIELD

GOLD OLDFIELD were the operators of the MegaCortex ransomware, which has been used in post-intrusion attacks. The initial intrusion vector leading to GOLD OLDFIELD attacks is unknown, although it may have been through existing commodity infections such as Emotet or Qakbot. Once in the environment, GOLD OLDFIELD is believed to have used PowerShell, Meterpeter and Cobalt Strike for lateral movement, with the ransomware ultimately being pushed using PSExec and credentials stolen from domain controllers.