GOLD BLADE Using Custom QWCrypt Locker that Allows Data Exfiltration and Ransomware Deployment

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GOLD BLADE Ransomware Campaign Using QWCrypt Locker Identified Between February 2024 and August 2025, Sophos threat analysts identified nearly 40 intrusions linked to the GOLD BLADE ransomware campaign. This campaign utilizes a custom QWCrypt locker for data exfiltration and ransomware deployment, affecting various organizations during this period. 3 sources 61