GOLD MANSARD is a financially motivated ransomware group known for evolving from Nemty to Nefilim and using double extortion.
Analyst brief
GOLD MANSARD is a financially motivated cybercriminal group, originally operating the Nemty ransomware under the alias 'jsworm' as a RaaS model, before transitioning to Nefilim ransomware. The group targets sectors including logistics, telecommunications, and energy, using post-intrusion ransomware attacks and double-extortion via data exfiltration and a 'name and shame' leak site. Key TTPs involve leveraging compromised credentials, exploiting exposed RDP, and deploying file-encrypting payloads with data theft for extortion. Defenders should prioritize securing remote access services, implementing robust data exfiltration detection, and tracking threat actor rebranding from Nemty to Nefilim infrastructure.
GOLD MANSARD
unknown
GOLD MANSARD is a financially motivated cybercriminal threat group that operated the Nemty ransomware from August 2019. The threat actor behind Nemty is known on Russian underground forums as 'jsworm'. Nemty was operated as a ransomware as a service (RaaS) affiliate program and featured a 'name and shame' website where exfiltrated victim data was leaked. In April 2020, jsworm appeared to acquire new partners and retired the Nemty ransomware. This was followed by the introduction of Nefilim ransomware, which does not operate as an affiliate model. Nefilim has been used in post-intrusion ransomware attacks against organizations in logistics, telecommunications, energy and other sectors.