Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

GOLD SYMPHONY

GOLD SYMPHONY is a threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2024-50623Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code…ExploitedcriticalCVE-2024-55956Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import…ExploitedcriticalCVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.ExploitedcriticalCVE-2022-30190A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word.ExploitedhighCVE-2023-27532Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the…ExploitedhighCVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version…high

Arsenal · Malware And Tools.

  • Buer Loadermalware
  • Cobalt Strikemalware
  • TrickBotmalware

About GOLD SYMPHONY.

GOLD SYMPHONY is a financially motivated cybercrime group, likely based in Russia, that is responsible for the development and sale on underground forums of the Buer Loader malware. First discovered around August 2019, Buer Loader is offered as a malware-as-a-service (MasS) and has been advertised by a threat actor using the handle 'memeos'. Customers include GOLD BLACKBURN, the operators of the TrickBot malware. In addition to TrickBot, Buer Loader has been reported to download Cobalt Strike and other tools for use in post-intrusion ransomware attacks.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.