GOLD HARVEST
GOLD HARVEST is a loosely organized, English-speaking cybercriminal collective associated with underground forums and encrypted chat channels tied to "The Com" ecosystem. It is also known as Scattered Spider. The group is known for social engineering-driven intrusions, particularly targeting IT help desks for initial access, and frequently abuses remote monitoring and management (RMM) tools and multi-factor authentication (MFA) bypass techniques. GOLD HARVEST is reported to steal bulk data and, in some cases, deploy ransomware. The group is also known to use commodity infostealers including Vidar and Raccoon to obtain browser-saved passwords, cookies, and session tokens. Reporting cited in the content states that GOLD HARVEST previously operated as a ransomware affiliate, deployed ALPHV ransomware in the 2023 MGM Resorts attack, and reportedly used RansomHub in attacks throughout 2024. Third-party reporting also linked the group to attacks on UK retailers in 2025; in the May 2025 Marks and Spencer incident, outside reporting publicly attributed the attack to GOLD HARVEST and stated that DragonForce ransomware was deployed, although official confirmation was not cited.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Consumer Discretionary Distribution & Retail
Where they target
Geographies tied to known operations.
- 🇬🇧 United Kingdom
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
English-speaking cybercriminal group noted only as having significant overlaps with GOLD CRYSTAL and affiliation to 'The Com' ecosystem.
Loosely organized cybercriminal collective associated with The Com that conducts intrusions using social engineering, credential theft, RMM abuse, and MFA bypass. It reportedly deployed DragonForce in attacks on UK retailers and previously acted as an affiliate for ALPHV and RansomHub.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.