Financially motivated cybercriminal group known for distributing malware via spam using the Necurs rootkit.
Analyst brief
GOLD RIVERVIEW was a financially motivated cybercriminal group that authored and sold the Necurs rootkit, facilitating malware and scam spam distribution for clients. They targeted a broad range of users and financial entities through large-scale spam campaigns. Their key TTPs included operating the Necurs botnet, conducting spam-based distribution, loading malware families such as Dridex, TrickBot, and Locky, and running 'pump and dump' securities scams. Defenders should focus on email gateway filtering, blocklisting Necurs-related indicators, and monitoring for the associated malware payloads.
GOLD RIVERVIEW
unknown
GOLD RIVERVIEW was a financially motivated cybercriminal group that facilitated the distribution of malware- and scam-laden spam email on behalf of its customers. This threat group authored and sold the Necurs rootkit beginning in early 2014, including to GOLD EVERGREEN who integrated it into Gameover Zeus. GOLD RIVERVIEW also operated a global botnet that was colloquially known as Necurs (CraP2P) and was a major source of spam email from 2016 through 2018. Necurs distributed malware such as GOLD DRAKE's Dridex (Bugat v5), GOLD BLACKBURN's TrickBot, and other families like Locky and FlawedAmmy. Necurs also distributed a large volume of email pushing securities 'pump and dump' scams, rogue pharmacies, and fraudulent dating sites. On March 4, 2019 all three active segments of the Necurs botnet ceased operation and have not since resumed. On March 10, 2020 Microsoft took civil action against GOLD RIVERVIEW and made technical steps that would complicate the threat actors' ability to reconstitute the botnet.
What was the primary botnet operated by GOLD RIVERVIEW and which malware families were distributed through it?+
GOLD RIVERVIEW operated a global botnet known as Necurs (CraP2P). This botnet was used to distribute malware families such as GOLD DRAKE's Dridex (Bugat v5), GOLD BLACKBURN's TrickBot, along with Locky and FlawedAmmy.