GOLD WINTER is a financially motivated cybercrime group independently operating Hades ransomware with name-and-shame tactics.
Analyst brief
GOLD WINTER is a financially motivated threat group, likely operating from Russia, associated with the Hades ransomware. Unlike Ransomware as a Service affiliates, they manage their operations independently and employ name-and-shame tactics using victim-specific Tor sites with unique Tox chat IDs for communication. Defenders should focus on the elevated risk of data exfiltration, monitor for customized leak sites, and review detection rules for Hades ransomware TTPs.
GOLD WINTER
unknown
GOLD WINTER are a financially motivated group, likely based in Russia, who operate the Hades ransomware. Hades activity was first identified in December 2020 and its lack of presence on underground forums and marketplaces leads CTU researchers to conclude that it is not operated under a ransomware as a service affiliate model. GOLD WINTER do employ name-and-shame tactics, where data is stolen and used as additional leverage over victims, but rather than a single centralized leak site CTU researchers have observed the group using Tor sites customized for each victim that include a Tox chat ID for communication, which also appears to be unique for each victim.