QWCrypt
QWCrypt is a custom ransomware strain operated by the financially motivated threat group GOLD BLADE, also tracked as RedCurl, Red Wolf, and Earth Kapre. Reporting indicates the group began deploying QWCrypt in mid-2025 after years of conducting tailored commercial espionage intrusions under a hack-for-hire model, suggesting a shift toward hybrid operations that combine espionage, data theft, and ransomware monetization.
Observed campaigns were heavily focused on Canadian organizations, with broader targeting also reported against entities in the U.S., Australia, and the U.K., including sectors such as services, manufacturing, retail, technology, NGOs, and transportation. Researchers described STAC6565 activity with high-confidence overlap to GOLD BLADE as blending data theft with selective QWCrypt ransomware deployment.
Initial access and delivery tradecraft associated with QWCrypt campaigns included spear-phishing and later abuse of recruitment platforms such as Indeed, JazzHR, and ADP WorkforceNow to deliver weaponized resumes, often aimed at HR personnel. The group used legitimately signed Adobe executables for DLL sideloading of its custom RedLoader malware. RedLoader transmitted host information to command-and-control infrastructure and executed PowerShell scripts to enumerate Active Directory environments. Additional tooling and behaviors reported in QWCrypt-linked intrusions included Sysinternals AD Explorer for host and security-product discovery, exfiltration of collected data in encrypted 7-Zip archives to attacker-controlled WebDAV servers, RPivot and Chisel SOCKS5 for communications, and a BYOVD chain using renamed Zemana drivers together with a modified Terminator EDR-killer tool to disable security products.
QWCrypt deployment was described as selective rather than universal across intrusions. In successful cases, deployment scripts were tailored to each victim, disabled recovery mechanisms, and executed the ransomware across endpoints and hypervisors. Cleanup actions included deletion of shadow copies and PowerShell history to inhibit recovery and forensic analysis. Most observed attacks were reportedly detected before QWCrypt installation, but several incidents in 2025 resulted in successful deployment.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In mid-2025, Sophos analysts observed the group starting to deploy custom ransomware, named QWCrypt, in some network compromises, suggesting that the threat actors may be independently monetizing intrusions in addition to conducting espionage for clients.
Sophos says that an e-crime named Gold Blade has been running ransomware attacks against Canadian organizations. The group has been active since 2018, is made up of Russian-speaking members, is also known as RedCurl, RedWolf, and Earth Kapre, and operates the QWCrypt ransomware strain.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware deployed in intrusions attributed to Gold Blade/STAC6565; Canada noted as a primary focus in the referenced campaign.
Previously unseen ransomware strain deployed by the RedCurl threat group in its first observed ransomware campaign.
A custom ransomware deployed by GOLD BLADE in some compromises beginning in mid-2025, indicating a shift from pure espionage and hack-for-hire activity toward direct monetization.
Ransomware used selectively within the STAC6565 campaign alongside data theft activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.