STAC6565 Targets Canada in 80% of Attacks as Gold Blade Deploys QWCrypt Ransomware

According to Sophos, a targeted cyber campaign orchestrated by a threat activity cluster known as STAC6565 has focused on Canadian organisations. Sophos said it investigated almost 40 intrusions linked to the threat actor between February 2024 and August 2025, with overlaps to the group known as Gold Blade (Earth Kapre/RedCurl/Red Wolf).

The campaign features ransomware deployment via a bespoke locker named QWCrypt, and RedLoader is used to relay host data to a C2 server while executing PowerShell to probe the AD environment. Sophos noted an unusually narrow geographic focus, with almost 80% of attacks directed at Canadian targets, and described Gold Blade as evolving from espionage to a hybrid operation that blends data theft with ransomware.

The group’s techniques include spear-phishing via recruitment platforms and a multi-stage delivery chain that culminates in QWCrypt deployment, according to Sophos researcher Morgan Demboski.