GOLD MANSARD

GOLD MANSARD is a financially motivated cybercriminal threat group that operated the Nemty ransomware from August 2019. The threat actor behind Nemty is known on Russian underground forums as "jsworm". Nemty was operated as a ransomware as a service (RaaS) affiliate program and featured a "name and shame" website where exfiltrated victim data was leaked. In April 2020, jsworm appeared to acquire new partners and retired the Nemty ransomware. This was followed by the introduction of Nefilim ransomware, which does not operate as an affiliate model. Nefilim has been used in post-intrusion ransomware attacks against organizations in logistics, telecommunications, energy and other sectors.

GOLD MANSARD has exploited vulnerabilities in internet-facing devices and services such as Citrix and Remote Desktop Protocol for initial access. The group then escalates privileges and uses tools common to other post-intrusion ransomware threat groups including Mimikatz for credential theft, AdFind for Active Directory enumeration, Cobalt Strike for post-exploitation activities and lateral movement, and MegaSync for data exfiltration. GOLD MANSARD then chooses the timing of distributing and executing Nefilim within the environment.