GOLD GARDEN

Executive Summary

GOLD GARDEN was a financially motivated cybercriminal group known for operating the GandCrab ransomware from January 2018 to May 2019. The group used a ransomware-as-a-service (RaaS) model, allowing affiliates to distribute the malware in exchange for a share of the loot. Their operations spanned multiple sectors and countries until they abruptly ceased activities in May 2019. The group's shutdown remains unresolved, though its source code was later transferred to GOLD SOUTHFIELD, who used it to launch the REvil ransomware operation.

Goals & Targeting

GOLD GARDEN's primary goal was to generate profit through ransomware attacks, targeting organizations that could afford to pay large sums for decryption keys. The group specifically targeted sectors such as healthcare, education, and logistics, where system downtime could lead to significant financial losses. Their global targeting reflects a strategic approach to maximize their attack surface, though their operations were heavily concentrated in regions with high internet usage and weaker security measures. Affiliates played a crucial role in expanding their reach, enabling the group to victimize numerous organizations worldwide.

GOLD GARDEN emerged as a significant player in the ransomware landscape by leveraging the GandCrab malware, which targeted numerous victims across various industries. The group's operational model involved distributing the ransomware through a network of affiliates, utilizing attack vectors such as spam emails, web exploit kits, and pay-per-install botnets. This approach allowed them to scale their operations efficiently while maintaining control over the core development and C2 infrastructure. In April 2019, GOLD GARDEN transferred the GandCrab source code to GOLD SOUTHFIELD, marking the end of their direct involvement in the ransomware operation. The reasons behind their cessation of activities remain unclear but may have included internal conflicts or external pressure. Their legacy lives on through the REvil ransomware project.

Key Capabilities

• Development of GandCrab ransomware
• Ransomware-as-a-Service (RaaS) operation management
• Affiliate recruitment and coordination
• Control over C2 infrastructure

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GOLD GARDEN's campaigns were characterized by a high volume of attacks, leveraging multiple distribution methods to maximize their reach. The group's affiliates operated independently but under the central control of GOLD GARDEN, which managed the ransomware's C2 infrastructure and collected payments. Notable campaigns included large-scale attacks on healthcare providers in the U.S. and Europe, leading to significant financial losses for victims. The abrupt shutdown of operations in May 2019 remains unexplained but may have been due to internal disputes or law enforcement pressure. Their transition of operations to GOLD SOUTHFIELD highlights their ability to adapt to changing circumstances.

IOC Patterns

• Spear-phishing emails with malicious macro-laced Office documents
• Distribution via web exploit kits targeting known vulnerabilities
• Use of legitimate cloud services for C2 communication
• Encrypted payloads delivered through HTTP

Recommended Actions

• Implement multi-layered email filtering to detect phishing attempts
• Enforce strict patch management to mitigate exploit kit attacks
• Monitor network traffic for signs of brute-force attacks or unusual patterns
• Train employees to recognize和社会工程攻击迹象

Suggested Tags