Threat actor
GOLD SALEM
Tracked by CyberSIXT since 15 Dec 2025
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 0
One article so far, 15 Dec 2025. A pattern appears once more outlets cover GOLD SALEM.
Names and sources
- GOLD SALEM
- Named by CyberSIXT coverage
- goldsalem
- Named by CyberSIXT coverage
Also mentioned alongside GOLD SALEM (not attributed)
1 CVE named in the same articlesShow 1 CVE
CVE-2025-1055K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege UserCVSS5.6Medium–Not in KEV0.2%EPSS0articles
- GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell ExploitationSecurityOnline · first in our coverage