Gold Melody cyber crime group selling access to breached networks to other cyber criminals

A group of hackers using the moniker "Gold Melody" has been found acting as an initial access broker, reselling previously-compromised network access to other threat actors.

Researchers at Secureworks Counter Threat Unit (CTU) said in a blog post that the cybercrime group Gold Melody was recently identified as an initial access broker (IAB) that sells access to compromised organisations for other cybercriminals to exploit.

Gold Melody, also known as UNC961 and Prophet Spider, is a financially-motivated group of cyber criminals, actively exploiting organisations since at least 2017. Its victims include industry giants in retail, health care, energy, finance, and high-tech organisations in North America, Northern Europe, and Western Asia.

“The victimology suggests opportunistic attacks for financial gain rather a targeted campaign conducted by a state-sponsored threat group for espionage, destruction, or disruption,” the researchers said.

Researchers at cyber security firm Mandiant said that the Gold Melody hacker group is responsible for exploiting the Log4Shell vulnerability (CVE-2021-44228) to access a MobileIron Core server, and exploiting a JBoss MQ Java Message Service (JMS) deserialisation vulnerability (CVE-2017-7504) on an internet-exposed server.

“BlackBerry observed the group exploiting Log4Shell in late 2021. CrowdStrike identified GOLD MELODY (referred to as PROPHET SPIDER) exploiting three vulnerabilities for initial access: two Oracle WebLogic directory traversal remote code execution (RCE) vulnerabilities (CVE-2020-14882 and CVE-2020-14750) in mid-2021 and a Citrix ShareFile RCE vulnerability (CVE-2021-22941) in early 2022,” they said.

Researchers at Secureworks have attributed at least five network intrusions between July 2020 and July 2022 to Gold Melody. The Secureworks IR engagements revealed the threat actors exploited multiple vulnerabilities in Oracle E-Business Suite (CVE-2016-0545), Apache Struts (CVE-2017-5638), Sitecore XP (CVE-2021-42237), and Flexera FlexNet (CVE-2021-4104) to gain initial access.

“Gold Melody conducts a considerable amount of scanning to understand a victim’s environment. Scanning begins shortly after gaining access but is repeated and continued throughout the intrusion,” the company said.

“Gold Melody acts as a financially motivated IAB, selling access to other threat actors. The buyers subsequently monetise the access, likely through extortion via ransomware deployment.

“Its reliance on exploiting vulnerabilities in unpatched internet-facing servers for access reinforces the importance of robust patch management,” Secureworks added.