Threat actor
GOLD SALEM
Tracked by CyberSIXT since 15 Dec 2025
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
One article so far, 15 Dec 2025. A pattern appears once more outlets cover GOLD SALEM.
Names and sources
- GOLD SALEM
- Named by CyberSIXT coverage
- goldsalem
- Named by CyberSIXT coverage
Also mentioned alongside GOLD SALEM (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to GOLD SALEM.
CVE-2025-1055K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege UserCVSS5.6Medium–Not in KEV0.2%EPSS0articles
- GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell ExploitationSecurityOnline · first in our coverage