Loading threat actor…
Emotet, tracked by Secureworks as GOLD CRESTWOOD, is a financially motivated cybercrime operation centered on the Emotet botnet. It has functioned as a malware delivery and access-enablement ecosystem that collaborates with other major criminal groups. High-confidence reporting places Emotet in regular communication with operators associated with Conti, TrickBot, LockBit, and IcedID-linked clusters, reflecting its role in a mature, cooperative cybercrime marketplace. Emotet has been used to provide second-stage malware delivery for other financially motivated operations. Documented activity includes its use to distribute follow-on payloads in support of Dridex-related campaigns run by Evil Corp. This places GOLD CRESTWOOD primarily in the initial-access and malware-delivery portion of the intrusion chain rather than as a ransomware brand itself in the supplied facts. Known aliases include GOLD CRESTWOOD and Emotet. The available information directly supports Emotet’s role as a botnet-enabled access and payload distribution service within the broader eCrime ecosystem, but does not provide high-confidence attribution to a specific country, victim-country set, or industry focus in this dataset.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
11 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.