Loading threat actor…
GOLD MYSTIC is the threat group that operates the LockBit ransomware-as-a-service ecosystem, active since mid-2019. LockBit became one of the most prolific financially motivated cybercrime operations globally, with victims publicly named across more than 100 countries by the end of 2023. The operation uses an affiliate model in which the core operators maintain the ransomware platform and leak-site brand while affiliates conduct intrusions, deploy ransomware, steal data, and in many cases handle victim negotiations and payments. LockBit activity spans both conventional ransomware deployment and extortion-only operations. Affiliates have conducted rapid enterprise-wide encryption, including automated deployment from domain controllers, and have also carried out data-theft-only extortion without encryption. The group has operated a public leak site and used stolen data as leverage, making double extortion and pure data-theft extortion central parts of its model. LockBit also expanded to Linux and VMware ESXi environments, increasing impact against virtualized infrastructure. Observed intrusion methods include abuse of stolen credentials and remote access pathways such as VPN, Citrix, and RDP, as well as exploitation of public-facing vulnerabilities including CVE-2023-4966. Affiliates have used common post-compromise tooling for credential access, reconnaissance, lateral movement, remote execution, and exfiltration, and have been observed disabling security products before ransomware detonation. Data theft has been conducted with both LockBit-associated tooling and commodity alternatives. The LockBit ecosystem is notable for its scale, permissive affiliate structure, and overlap with the broader cybercrime marketplace. Affiliates have moved between ransomware programs, and LockBit operators have at times allowed use of the platform alongside other ransomware brands. After the LockBit 3.0 builder leaked in 2022, copycat actors also abused the LockBit name for fraudulent or opportunistic extortion. In February 2024, an international law-enforcement operation led by the UK National Crime Agency and the U.S. FBI disrupted LockBit infrastructure, but the affiliate-driven ecosystem surrounding the brand has shown resilience. Known aliases in the provided context include GOLD MYSTIC and LockBit.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates the LockBit RaaS ecosystem, enabling affiliates to conduct ransomware and data-theft extortion at scale, including encryption of Windows and VMware ESXi environments and leak-site based extortion.
Named as a separate threat group whose representatives frequently communicated with Stern and members of GOLD ULRICK and GOLD BLACKBURN.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.