GOLD TOPAZ

The GOLD TOPAZ threat group was responsible for operating the RagnarLocker name-and-shame ransomware, which was active from at least late 2019. In March 2022, the FBI reported that RagnarLocker had impacted at least 52 entities across different industry verticals but by the time the last victim was named on a dedicated leak site in September 2023, the details of 95 victims had been made public.
CTU researchers observed GOLD TOPAZ gain initial access using phishing emails to harvest credentials but other access vectors may also have been used. Once in a network, RagnarLocker intrusions were characterized by the use of Cobalt Strike, LSASS dumping for credential theft and use of PsExec for lateral movement. In some intrusion activity observed by CTU researchers, backup systems were impacted, making data recovery more challenging.
According to FBI reporting, RagnarLocker used VMProtect, UPX, and custom packing algorithms, and deployed within the threat actor's custom Windows XP VM on the compromised host. Windows APIs were used to ensure that the victim machine was not using a system configuration consistent with eastern Europe and central Asia. A unique identifier per infection was generated based on system information to prevent multiple concurrent infections of the same host. The ransomware made all connected devices accessible for subsequent encryption. It then iterated through and terminated common processes associated with remote access solutions, likely to make incident response harder, deleted volume shadow copies using vssadmin and WMI, and then encrypted files that were not situated in a hardcoded folder exception list. Files were appended with a .RGNR_ extension, where is a hash of the machine's NETBIOS name, and a .txt ransom note is dropped providing instructions on how to pay the ransom and decrypt data.