Loading threat actor…
GOLD MYSTIC is the financially motivated cybercriminal group operating the LockBit ransomware-as-a-service (RaaS) and data-extortion platform. Its ransomware operations began in mid-2019; it adopted the LockBit malware name in 2020 and began publishing victims on its leak site in September 2020. By December 2023, the platform had named more than 2,350 victims across 112 countries. Confirmed targets include Canada's SickKids children's hospital and the United Kingdom's Royal Mail. The operation uses a decentralized affiliate model, delegating ransom negotiations and payment handling to affiliates with limited operator oversight. Attacks include encryption combined with threats to publish stolen data, as well as data-theft-only extortion. GOLD MYSTIC developed the StealBit exfiltration tool and released LockBit 2.0 in June 2021 and Linux- and VMware ESXi-compatible variants in late 2021. Its LockBitSupp persona promoted access to the extortion platform for affiliates using other ransomware families and recruited affiliates from disrupted competing operations. LockBit affiliates obtain access through compromised credentials, exposed remote-access services, vulnerability exploitation, and malware delivery chains such as Gootloader. Observed techniques include exploitation of Citrix Bleed, CVE-2023-4966, to steal authenticated session tokens and bypass MFA; network and directory reconnaissance; credential theft; lateral movement through RDP and PsExec; persistence through remote-administration software; and automated ransomware distribution from domain controllers. Affiliates exfiltrate data using StealBit and third-party transfer tools, disable security software, impair recovery, clear logs, and encrypt VMware ESXi infrastructure to disrupt hosted virtual machines. GOLD MYSTIC representatives maintained communications with members of GOLD ULRICK and GOLD BLACKBURN, reflecting collaboration within the wider cybercriminal ecosystem rather than established common leadership. On February 19, 2024, the UK's National Crime Agency, the FBI, and international partners disrupted LockBit infrastructure, seized funds, and targeted associated individuals. The September 2022 leak of the LockBit 3.0 builder also enabled unrelated copycats, so LockBit-branded activity does not by itself establish affiliation with GOLD MYSTIC.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.