GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes

GOLD BLADE, a threat actor also known as RedCurl or RedWolf, has pivoted its focus to Canada, according to a Sophos report that describes a campaign blending corporate espionage with ransomware. Between February 2024 and August 2025, analysts tracked nearly 40 intrusions linked to the group’s “STAC6565” campaign, with almost 80% of attacks targeting Canadian organisations.

The group has moved away from traditional phishing, instead abusing recruitment platforms such as Indeed, JazzHR and ADP Workforce Now to deliver weaponised resumes to HR departments. Once opened, the malicious resume triggers a multi-stage infection chain delivering RedLoader, a custom loader that evolved from DLL sideloading to chains involving WebDAV servers, Cloudflare Workers and disguised system files.

They employ a Bring Your Own Vulnerable Driver (BYOVD) technique, deploying a customised Terminator EDR killer tool alongside a signed but vulnerable Zemana AntiMalware driver to disable security at the kernel level, including modifications to the Windows registry to disable the vulnerable driver blocklist and Hypervisor-Enforced Code Integrity. The article notes that attribution remains uncertain, though the operation is described as professionalised with persistent, targeted activity.