Threat actor
Gold Blade
Tracked by CyberSIXT since 9 Dec 2025
- Articles · all time
- 2
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 1
Names and sources
- Earth Kapre
- Named by CyberSIXT coverage
- Earth Kapre
- Named by Malpedia · earth_kapre
- GOLD BLADE
- Named by Malpedia · earth_kapre
- Red Wolf
- Named by Malpedia · earth_kapre
- RedCurl
- Named by Malpedia · earth_kapre
- Earth Kapre
- Named by MISP Galaxy · d4004926-bf12-4cfe-b141-563c8ffb304a
- GOLD BLADE
- Named by MISP Galaxy · d4004926-bf12-4cfe-b141-563c8ffb304a
- Red Wolf
- Named by MISP Galaxy · d4004926-bf12-4cfe-b141-563c8ffb304a
All 12 names
- RedCurl
- Named by MISP Galaxy · d4004926-bf12-4cfe-b141-563c8ffb304a
- RedCurl
- Named by MITRE ATT&CK® · G1039
- Gold Blade
- Named by CyberSIXT coverage
- d4004926-bf12-4cfe-b141-563c8ffb304a
- Named by CyberSIXT coverage
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1039
Tactics pending refresh
- T1003.001
- LSASS Memory
- T1005
- Data from Local System
- T1020
- Automated Exfiltration
- T1027
- Obfuscated Files or Information
- T1036.005
- Match Legitimate Resource Name or Location
- T1039
- Data from Network Shared Drive
- T1046
- Network Service Discovery
- T1053.005
- Scheduled Task
- T1056.002
- GUI Input Capture
- T1059.001
- PowerShell
- T1059.003
- Windows Command Shell
- T1059.005
- Visual Basic
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake ResumesSecurityOnline
- STAC6565 Targets Canada in 80% of Attacks as Gold Blade Deploys QWCrypt RansomwareThe Hacker News · first in our coverage