Understanding GOLD SALEM’s Ransomware Strategy

The cybersecurity landscape was recently rocked by insights from the Counter Threat Unit (CTU) regarding GOLD SALEM, a persistent cybercriminal group. These digital miscreants have been particularly active in deploying the notorious Warlock ransomware. Emerging investigations, starting around mid-2025, have spotlighted this group’s systematic targeting of government and industrial sectors.

In their covert operations, GOLD SALEM has cleverly integrated legitimate tools such as Velociraptor, a digital forensics application, to infiltrate systems. The first sightings of Warlock ransomware date back to March 2025, but it wasn’t until July that it became a recognized cyber threat. Their attacks often leverage zero-day vulnerabilities within Microsoft SharePoint, exploiting these through a hack named ToolShell, linked to a threat entity called Storm-2603 by Microsoft, but known to CTU as GOLD SALEM.

The Tactical Approach of GOLD SALEM

The group’s strategic use of ransomware is highly sophisticated. Their approach involves exploiting system vulnerabilities, establishing administrative accounts for persistent access, and employing scripts to control compromised systems. A standout tactic includes sophisticated anti-virus evasion using “vmtools.exe” to bypass security protocols.

Adding to their technical arsenal, GOLD SALEM has adopted DLL side-loading techniques and maintains a complex command infrastructure. This infrastructure often uses tools like Cloudflared for discreet communications and managing operations. Interestingly, these cybercriminals also swap between using Warlock, LockBit, and Babuk ransomware, adapting to the attack environment.

Many of their targets seem to align with interests typical of state-sponsored espionage. This suggests that GOLD SALEM may be engaging in dual-purpose operations—both for financial gain and as fronts for intelligence collection. CTU’s concluding advice is clear: robust cybersecurity measures are imperative, particularly concerning the exposure of SharePoint servers, to counter such sophisticated threats effectively.

For more insights and updates on cybersecurity trends, visit Qsentinel’s blog.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.