GOLD DUPONT

Also known as: GOLD DUPONT, Gold Dupont, SPRITE SPIDER, Sprite Spider

GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka Defray777 or RansomExx) malware. Active since November 2018, GOLD DUPONT establishes initial access into victim networks using stolen credentials to remote access services like virtual desktop infrastructure (VDI) or virtual private networks (VPN). From October 2019 to early 2020 the group used GOLD BLACKBURN’s TrickBot malware as an initial access vector (IAV) during some intrusions. Since July 2020, the group has also used GOLD SWATHMORE’s IcedID (Bokbot) malware as an IAV in some intrusions.

🌍 Country ["[Unknown]"]

Associated Operations

2017-08 2020-05 2020-06 2020-08 2020-09 2020-10 2020-11 2020-12 2021-02 2021-07 2021-08 2022-03 2022-10 2022-11 Brazil's court system under massive RansomExx ransomware attack Brazil’s largest clothing store chain Business technology giant Konica Minolta hit by new ransomware Computer hardware giant GIGABYTE hit by RansomEXX ransomware Ecuador's state-run CNT telco hit by RansomEXX ransomware French MNH health insurance company hit by RansomExx ransomware Government software provider Tyler Technologies hit by ransomware Hackers leak data from Embraer Hypervisor Jackpotting: CARBON SPIDER and SPRITE SPIDER Target ESXi Servers With Ransomware to Maximize Impact Leading U.S. laser developer IPG Photonics hit with ransomware Montreal's STM public transport system hit by ransomware attack New Defray Ransomware Targets Education and Healthcare Verticals New Ransom X Ransomware used in Texas TxDOT cyberattack RansomEXX ransomware leaks files stolen from Italian luxury brand Zegna RansomExx Leaks 52GB of Barcelona Health Centers' Data RansomExx Upgrades to Rust RansomExx ransomware also encrypts Linux systems Ransomware group attacks Scottish mental health charity Ransomware hits Lojas Renner SoftServe hit by ransomware Texas Courts hit by ransomware Windows customization tool exploited https://securityaffairs.co/wordpress/120898/data-breach/ransomexx-ransomware-zegna.html https://securityintelligence.com/posts/ransomexx-upgrades-rust/ https://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/ https://therecord.media/ransomware-hits-lojas-renner-brazils-largest-clothing-store-chain/ https://www.bankinfosecurity.com/ransomexx-leaks-52-gb-barcelona-health-centers-data-a-20260 https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/ https://www.bleepingcomputer.com/news/security/business-technology-giant-konica-minolta-hit-by-new-ransomware/ https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware/ https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/ https://www.bleepingcomputer.com/news/security/french-mnh-health-insurance-company-hit-by-ransomexx-ransomware/ https://www.bleepingcomputer.com/news/security/government-software-provider-tyler-technologies-hit-by-ransomware/ https://www.bleepingcomputer.com/news/security/leading-us-laser-developer-ipg-photonics-hit-with-ransomware/ https://www.bleepingcomputer.com/news/security/montreals-stm-public-transport-system-hit-by-ransomware-attack/ https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ https://www.bleepingcomputer.com/news/security/ransomexx-ransomware-also-encrypts-linux-systems/ https://www.bleepingcomputer.com/news/security/softserve-hit-by-ransomware-windows-customization-tool-exploited/ https://www.bleepingcomputer.com/news/security/texas-courts-hit-by-ransomware-network-disabled-to-limit-spread/ https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/ https://www.proofpoint.com/us/blog/threat-insight/new-defray-ransomware-targets-education-and-healthcare-verticals https://www.zdnet.com/article/hackers-leak-data-from-embraer-worlds-third-largest-airplane-maker/ network disabled to limit spread world's third-largest airplane maker

Introduction

GOLD DUPONT is a financially motivated cybercriminal threat group that specializes in post-intrusion ransomware attacks using 777 (aka Defray777 or RansomExx) malware. Active since November 2018, GOLD DUPONT establishes initial access into victim networks using stolen credentials to remote access services like virtual desktop infrastructure (VDI) or virtual private networks (VPN). From October 2019 to early 2020 the group used GOLD BLACKBURN’s TrickBot malware as an initial access vector (IAV) during some intrusions. Since July 2020, the group has also used GOLD SWATHMORE’s IcedID (Bokbot) malware as an IAV in some intrusions.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2017-08
  • 2020-05
  • 2020-06
  • 2020-08
  • 2020-09
  • 2020-10
  • 2020-11
  • 2020-12
  • 2021-02
  • 2021-07
  • 2021-08
  • 2022-03
  • 2022-10
  • 2022-11
  • Brazil’s court system under massive RansomExx ransomware attack
  • Brazil’s largest clothing store chain
  • Business technology giant Konica Minolta hit by new ransomware
  • Computer hardware giant GIGABYTE hit by RansomEXX ransomware
  • Ecuador’s state-run CNT telco hit by RansomEXX ransomware
  • French MNH health insurance company hit by RansomExx ransomware
  • Government software provider Tyler Technologies hit by ransomware
  • Hackers leak data from Embraer
  • Hypervisor Jackpotting: CARBON SPIDER and SPRITE SPIDER Target ESXi Servers With Ransomware to Maximize Impact
  • Leading U.S. laser developer IPG Photonics hit with ransomware
  • Montreal’s STM public transport system hit by ransomware attack
  • New Defray Ransomware Targets Education and Healthcare Verticals
  • New Ransom X Ransomware used in Texas TxDOT cyberattack
  • RansomEXX ransomware leaks files stolen from Italian luxury brand Zegna
  • RansomExx Leaks 52GB of Barcelona Health Centers’ Data
  • RansomExx Upgrades to Rust
  • RansomExx ransomware also encrypts Linux systems
  • Ransomware group attacks Scottish mental health charity
  • Ransomware hits Lojas Renner
  • SoftServe hit by ransomware
  • Texas Courts hit by ransomware
  • Windows customization tool exploited
  • https://securityaffairs.co/wordpress/120898/data-breach/ransomexx-ransomware-zegna.html
  • https://securityintelligence.com/posts/ransomexx-upgrades-rust/
  • https://therecord.media/ransomware-group-attacks-scottish-mental-health-charity/
  • https://therecord.media/ransomware-hits-lojas-renner-brazils-largest-clothing-store-chain/
  • https://www.bankinfosecurity.com/ransomexx-leaks-52-gb-barcelona-health-centers-data-a-20260
  • https://www.bleepingcomputer.com/news/security/brazils-court-system-under-massive-ransomexx-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/business-technology-giant-konica-minolta-hit-by-new-ransomware/
  • https://www.bleepingcomputer.com/news/security/computer-hardware-giant-gigabyte-hit-by-ransomexx-ransomware/
  • https://www.bleepingcomputer.com/news/security/ecuadors-state-run-cnt-telco-hit-by-ransomexx-ransomware/
  • https://www.bleepingcomputer.com/news/security/french-mnh-health-insurance-company-hit-by-ransomexx-ransomware/
  • https://www.bleepingcomputer.com/news/security/government-software-provider-tyler-technologies-hit-by-ransomware/
  • https://www.bleepingcomputer.com/news/security/leading-us-laser-developer-ipg-photonics-hit-with-ransomware/
  • https://www.bleepingcomputer.com/news/security/montreals-stm-public-transport-system-hit-by-ransomware-attack/
  • https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
  • https://www.bleepingcomputer.com/news/security/ransomexx-ransomware-also-encrypts-linux-systems/
  • https://www.bleepingcomputer.com/news/security/softserve-hit-by-ransomware-windows-customization-tool-exploited/
  • https://www.bleepingcomputer.com/news/security/texas-courts-hit-by-ransomware-network-disabled-to-limit-spread/
  • https://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/
  • https://www.proofpoint.com/us/blog/threat-insight/new-defray-ransomware-targets-education-and-healthcare-verticals
  • https://www.zdnet.com/article/hackers-leak-data-from-embraer-worlds-third-largest-airplane-maker/
  • network disabled to limit spread
  • world’s third-largest airplane maker

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • BlackEnergy
  • RemoteCMD
  • BLACKCOFFEE
  • Blackshades
  • BlackNix
  • CyberGate
  • Cyber Eye RAT
  • Remote Utilities
  • RemotePC
  • DesktopNow
  • Cobalt Strike:
  • Defray777:
  • LaZagne:
  • Metasploit:
  • PyXie:
  • SharpHound:
  • Shifu:
  • SystemBC:
  • Vatet:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.