STAC6565 Shifts Focus to Canada in QWCrypt Ransomware Attacks

STAC6565 Targets Canada in 80% of Attacks

The threat activity cluster STAC6565, linked to the Gold Blade hacking group, has intensified its cyberattacks, with a striking 80% of recent intrusions targeting organizations in Canada. Sophos investigated almost 40 intrusions linked to this actor between February 2024 and August 2025, revealing a shift from primarily cyber espionage to a hybrid model incorporating ransomware deployment.

Why This Matters

Current threat intelligence often relies on broad indicators of compromise, while sophisticated groups like STAC6565 demonstrate a capacity for rapid adaptation and targeted attacks. The financial impact of successful ransomware attacks on critical infrastructure can exceed millions of dollars, and the disruption to services can be severe, highlighting the need for proactive defense strategies.

Key Insights

• RedLoader delivery chain observed in September 2024, March/April 2025, and July 2025: Sophos, Huntress, eSentire, and Bitdefender all documented variations.
• BYOVD attacks: The group utilizes Bring Your Own Vulnerable Driver (BYOVD) attacks, leveraging signed drivers to disable antivirus software.
• Recruitment platform abuse: STAC6565 exploits job search platforms like Indeed to host malicious resumes, increasing the likelihood of successful phishing attacks.

Working Example

# Example of checking for suspicious file extensions (simplified)
import os

def check_suspicious_files(directory):
    suspicious_extensions = ['.lnk', '.zip', '.bat', '.exe']
    for filename in os.listdir(directory):
        if any(filename.endswith(ext) for ext in suspicious_extensions):
            print(f"Potential threat: {filename}")

# Example usage:
# check_suspicious_files("/path/to/downloaded/files")

Practical Applications

• Canadian Critical Infrastructure: Organizations in sectors like energy, finance, and healthcare in Canada should increase monitoring and threat hunting activities.
• Pitfall: Relying solely on email-based security solutions. STAC6565’s use of legitimate platforms bypasses these defenses, requiring endpoint detection and response (EDR) solutions.

References:

• https://thehackernews.com/2025/12/stac6565-targets-canada-in-80-of.html