Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

GOLD SALEM is a financially motivated cybercrime group deploying Warlock ransomware through sophisticated tradecraft, including exploiting SharePoint vulnerabilities for initial access. Over six months and 11 incidents, they targeted IT, industrial, and technology sectors using ransomware variants such as Warlock, LockBit, and Babuk. Their operations involve advanced techniques like zero-day exploitation and repurposing legitimate tools (Velociraptor, VMTools AV killer, Cloudflared) to evade detection and maintain persistence. Executables are often named after victim organizations, indicating targeted attacks. While evidence suggests possible Chinese origins, the group primarily pursues financial gain. The threat poses a medium severity risk but demonstrates capabilities that could escalate impact if defenses are weak. European organizations in critical infrastructure and technology sectors should be vigilant against these tactics.

The GOLD SALEM cybercrime group has demonstrated a sophisticated and evolving ransomware deployment strategy centered around the Warlock ransomware family, supplemented by LockBit and Babuk variants. Their operations span at least six months and 11 documented incidents, primarily targeting IT, industrial, and technology sectors. Initial access is frequently gained through exploitation of SharePoint vulnerabilities, which remain a common attack vector due to misconfigurations and unpatched systems. Post-compromise, GOLD SALEM employs advanced tools such as Velociraptor for endpoint visibility and control, VMTools AV killer to disable antivirus defenses, and Cloudflared to establish covert command and control channels. Their use of zero-day exploits indicates high technical capability and resource investment. The group customizes ransomware executables by naming them after victim organizations, suggesting reconnaissance and targeted attack planning. Despite some indicators pointing to Chinese origins, the group’s primary motivation is financial extortion rather than espionage. Their tactics align with multiple MITRE ATT&CK techniques including credential dumping (T1003), lateral movement (T1133), ransomware deployment (T1486), and defense evasion (T1140, T1567). The absence of known public exploits for their zero-days suggests a controlled and stealthy approach. Overall, GOLD SALEM represents a persistent and technically adept ransomware threat actor leveraging a blend of zero-day vulnerabilities and legitimate tools to maximize impact and evade detection.

Detailed information about GOLD SALEM tradecraft for deploying Warlock ransomware. Get real-time updates, technical details, and mitigation strategies.

GOLD SALEM tradecraft for deploying Warlock ransomware - Live Threat Intelligence - Threat Radar | OffSeq.com

GOLD SALEM tradecraft for deploying Warlock ransomware

Title	Severity	Type	Source	Date

Threats Tagged 'vasa locker'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'vasa locker'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility