Threat Investigation
Request a demo
Cybercrime

GOLD DUPONT

GOLD DUPONT is classified as cybercrime.

Malware families
2
Also known as
1

GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka Defray777 or RansomExx) malware. Active since November 2018, GOLD DUPONT establishes initial access into victim networks using stolen credentials to remote access services like virtual desktop infrastructure (VDI) or virtual private networks (VPN). From October 2019 to early 2020 the group used GOLD BLACKBURN's TrickBot malware as an initial access vector (IAV) during some intrusions. Since July 2020, the group has also used GOLD SWATHMORE's IcedID (Bokbot) malware as an IAV in some intrusions.

The group is associated with 2 malware families.

Also known as: SPRITE SPIDER

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.