Which ransomware is linked to the GOLD LOWELL threat group and targets unpatched servers?

• A. Lazarus Group
• B. GOLD LOWELL
• C. APT28
• D. Cozy Bear

Answer: (B)

Understanding how threat groups are linked to ransomware often comes down to naming and known attack patterns. When a group is identified with a ransomware family that bears the same name, that ransomware is the one associated with that group. Here, the ransomware is named GOLD LOWELL, which is the same label used for the GOLD LOWELL threat group. Security reports describe this group deploying GOLD LOWELL to encrypt systems, and a notable tactic they’ve used is targeting unpatched servers to gain initial access and spread.

The other groups listed—Lazarus Group, APT28, and Cozy Bear—are well-known state-aligned actors with their own separate campaigns and malware lines. They do not match the specific GOLD LOWELL ransomware and its described method of exploiting unpatched servers, so they aren’t the correct attribution in this scenario.