CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

STAC6565 Targets Canadian Organizations with QWCrypt Ransomware

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The threat activity cluster STAC6565, linked to Gold Blade (Earth Kapre, RedCurl, Red Wolf), has targeted Canadian organizations in 80% of its attacks between February 2024 and August 2025. The group, active since late 2018, initially focused on cyber espionage but has evolved to deploy QWCrypt ransomware. The campaign uses spear-phishing emails targeting HR personnel, leveraging legitimate job search platforms to deliver malicious documents. The group operates under a 'hack-for-hire' model, blending data theft with ransomware deployment. Sophos researchers noted that the group's operational tempo includes periods of inactivity followed by sudden spikes in attacks, indicating toolset refinement during downtime. The attacks involve sophisticated multi-stage malware delivery chains, including the use of RedLoader and custom tools like Terminator for disabling antivirus processes. Despite detection and mitigation efforts, three attacks resulted in successful QWCrypt deployment.

Timeline

  1. 09.12.2025 11:35 1 articles · 23h ago

    STAC6565 Deploys QWCrypt Ransomware in Targeted Campaign

    Between February 2024 and August 2025, STAC6565 conducted nearly 40 intrusions targeting Canadian organizations, deploying QWCrypt ransomware via a multi-stage malware delivery chain. The group uses spear-phishing emails targeting HR personnel, leveraging legitimate job search platforms to deliver malicious documents. The attacks involve the use of ZIP archives, Windows shortcuts (LNK), and WebDAV servers for payload delivery. The group employs custom tools like Terminator to disable antivirus processes, with three successful QWCrypt deployments observed in April and July 2025.

    Show sources
    Open in new tab

Information Snippets