Gold Dupont

GOLD DUPONT, also written as GoldDupont, is a financially motivated cybercriminal threat group active since at least 2018 and associated with operating and distributing RansomExx ransomware. It has compromised organizations in the United States, Canada, and Brazil. Its ransomware operations encompass Windows and Linux environments, including systems storing VMware virtual-machine files. The group's intrusion toolset includes IcedID, Vatet loader, Pyxie, TrickBot, Cobalt Strike, and SystemBC. Observed initial-access methods include phishing attachments containing macro-enabled Word documents and access through Citrix infrastructure. In one campaign, a password-protected archive delivered a malicious document that installed IcedID, followed by post-compromise tooling and ransomware deployment within approximately five hours. The intrusion used scheduled-task persistence, steganographic payload delivery, and in-memory code injection. A trojanized Notepad++ application served as Vatet loader to decrypt and execute additional payloads. Post-compromise activity included host reconnaissance, credential-gathering tools such as LaZagne and Mimikatz, and lateral movement over SMB. RansomExx variants associated with the operation encrypt files on Windows and Linux systems. Linux variants use multithreaded encryption and have targeted VMware-related storage, enabling disruption of virtualized environments. GOLD DUPONT remained associated with RansomExx intrusions in 2023.