GOLD WESTMORE

GOLD WESTMORE is the name used by the CTU to track the threat group responsible for deploying the LockerGoga malware in post intrusion ransomware attacks. LockerGoga was linked to an attack on an engineering consulting firm in January 2019, and a renewable energy firm in March 2019. While the initial infection vector in these incidents has not been confirmed, the lack of any lateral expansion capability within the LockerGoga malware suggests that GOLD WESTMORE had wide-scale access to victims' networks prior to deploying the ransomware.

GOLD WESTMORE made extensive use of the Cobalt Strike and Metasploit tools for post-exploitation activity. The group obtained valid credentials for lateral movement, and used Active Directory Group Policy Objects for distribution of the LockerGoga ransomware to target hosts.

Ransom payments were made through bitcoin in order to secure a decryption tool. The CTU had limited direct visibility as to whether paying secured the decryption tool, or the efficacy of that tool once it had been obtained.