Loading threat actor…
GOLD REBELLION is a financially motivated cybercrime threat actor associated with Black Basta ransomware activity. The group has been linked to large-scale social-engineering intrusions in which operators impersonate internal IT or helpdesk personnel over Microsoft Teams voice and chat to persuade users to grant remote access. Observed operations heavily targeted North American organizations, especially in Canada and the United States, across services, manufacturing, energy, construction and engineering, with legal-sector victims notably concentrated in intellectual-property services. After initial access, GOLD REBELLION operators have used legitimate remote-support tooling to establish control, then executed PowerShell-based payload delivery and enabled Remote Desktop Protocol to expand access. Intrusions have featured a modular malware chain including a custom loader, a PyInstaller-based backdoor, Golang implants, and in some cases additional remote administration tools and a reverse SOCKS proxy. The malware has supported host profiling, command execution, system-information collection, alternate access channels, and segmented command-and-control communications. Persistence has been established through user Run-key entries and Startup-folder shortcut mechanisms disguised as benign software components. The actor has shown rapid adaptation to defensive pressure, frequently changing payload names, persistence artifacts, and delivery methods, and in at least one case experimenting with DLL sideloading. Multiple compromises attributed to this activity cluster culminated in Chaos ransomware deployment, including at least one intrusion that progressed from initial access to encryption in under 17 hours. Available evidence supports a cybercriminal, profit-driven role focused on access operations, post-compromise expansion, and ransomware enablement or deployment rather than espionage.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.