GOLD DUPONT

GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka Defray777 or RansomExx) malware. Active since November 2018, GOLD DUPONT establishes initial access into victim networks using stolen credentials to remote access services like virtual desktop infrastructure (VDI) or virtual private networks (VPN). From October 2019 to early 2020 the group used GOLD BLACKBURN's TrickBot malware as an initial access vector (IAV) during some intrusions. Since July 2020, the group has also used GOLD SWATHMORE's IcedID (Bokbot) malware as an IAV in some intrusions.

Qrup 2 zərərli proqram ailəsi ilə əlaqələndirilib.

Digər adları: SPRITE SPIDER

Qrup 2 zərərli proqram ailəsi ilə əlaqələndirilib.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.secureworks.com/research/threat-profiles/gold-dupont
• https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/
• https://www.youtube.com/watch?v=qxPXxWMI2i4

Mənbə: MISP Galaxy, Malpedia.