GOLD GARDEN was a financially motivated cybercriminal threat group that authored and operated the GandCrab ransomware from January 2018 through May 2019. GandCrab was operated as a ransomware-as-a-service operation whereby numerous affiliates distributed the malware and split ransom payments with the core operators. GOLD GARDEN maintained exclusive control of the development of GandCrab and associated command and control (C2) infrastructure. Individual affiliates, of which there were frequently more than a dozen in operation simultaneously, coordinated the distribution of GandCrab through spam emails, web exploit kits, pay-per-install botnets, and scan-and-exploit style attacks. On May 31, 2019 the operators announced they have halted operations with no intent to resume for unknown reasons. In April 2019 the operators of GOLD GARDEN transferred the source code of GandCrab to GOLD SOUTHFIELD who used it as the foundation of the REvil ransomware operation. GOLD SOUTHFIELD operates a similar affiliate program comprised largely of former GandCrab users and other groups recruited from underground forums.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | GOLD GARDEN |
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names GOLD GARDEN, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to GOLD GARDEN. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.