GOLD BLADE Using Custom QWCrypt Locker that Allows Data Exfiltration and Ransomware Deployment
The GOLD BLADE threat group has transitioned from espionage activities to a hybrid model incorporating data theft and targeted ransomware attacks using a custom locker known as QWCrypt.
The GOLD BLADE threat group has transitioned from espionage activities to a hybrid model incorporating data theft and targeted ransomware attacks using a custom locker known as QWCrypt.
This shift is part of a campaign identified as STAC6565, which affected approximately 40 victims from early 2024 to mid-2025, primarily targeting Canadian organizations in sectors such as service, manufacturing, retail, and technology.
The group exploits trusted recruitment platforms, including Indeed, JazzHR, ADP, and LinkedIn, submitting fake resumes containing either first-stage malware or redirecting HR personnel to fraudulent portals that deliver malicious content.
These resumes often bypass email security checks due to their integration within standard hiring workflows.
Sophos security analysts have identified this evolution, linking it to a sophisticated RedLoader delivery chain culminating in QWCrypt deployment on high-value systems.
The group employs cycles of inactivity followed by short bursts of intrusion activity, introducing new tools, scripts, and evasion techniques with each wave.
QWCrypt enables GOLD BLADE to transform espionage activities into extortion events. The locker appends the .qwCrypt extension, leaves a note titled “!!!how_to_unlock_qwCrypt_files.txt,” and includes multiple operational modes, including targeting hypervisors hosting virtual machines.
These resumes often bypass email security checks due to their integration within standard hiring workflows.
Exfiltrated data is archived using 7-Zip and transmitted via WebDAV through Cloudflare Workers domains, allowing for data leak threats even if encryption attempts fail.
Upon opening a compromised resume, a multi-stage infection chain is triggered. This may involve a ZIP file containing either a fake PDF shortcut or an ISO image.
The file executes a renamed version of ADNotificationManager.exe, which sideloads a RedLoader DLL such as srvcli.dll or netutils.dll via rundll32.exe from a WebDAV share managed by Cloudflare Workers.
The initial DLL establishes contact with command-and-control (C2) servers, subsequently creating scheduled tasks to download further payloads into the user's AppData\Roaming directory under innocuous names like “BrowserEngineUpdate_.”
These tasks utilize the pcalua.exe binary to execute payloads without leaving significant traces.
A batch script unpacks Sysinternals AD Explorer, executes network discovery commands, compresses results with 7-Zip, and uploads them to attacker-controlled WebDAV servers, such as local.chronotypelabs[.]workers[.]dev.
For QWCrypt deployment, an encrypted 7-Zip archive is distributed over SMB to multiple servers. A launcher script confirms the presence of their Terminator-based antivirus disabling service, deactivates recovery options, and executes the locker:
bcdedit /set {default} recoveryenabled no qwc_537aab1c.exe -v -key <key> -nosd
Terminator leverages a vulnerable Zemana AntiMalware driver to terminate protected processes and weakens core Windows defenses by altering key registry values:
HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0x0 /f HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0x0 /f
A final script executes QWCrypt with hypervisor options as necessary, deletes shadow copies, and clears PowerShell history, leaving only encrypted data and the ransom note.
Based on reporting by Cyber Security News.