The Reveal Platform
Intel Name: Gold salem’s warlock operation joins busy ransomware landscape
Date of Scan: September 19, 2025
Impact: High
Summary: As of mid-September 2025, GOLD SALEM has named 60 victims, placing it mid-tier among active ransomware groups. Its targets range from small entities to major multinational firms across North America, Europe, and South America. Consistent with typical ransomware behavior, the group has mostly avoided victims in China and Russia. However, on September 8, it listed a Russian engineering firm serving the power industry on its leak site. This move suggests GOLD SALEM may be operating outside Russian jurisdiction, given the country’s strict stance on domestic attacks.
