⚠️ Overview

GOSH is a modular ransomware‑as‑a‑service (RaaS) operation first documented by Fortinet’s FortiGuard Labs in March 2021, attributed to a Russian‑speaking threat actor tracked as TA1013. It belongs to the ransomware category and encrypts files on Windows systems while demanding payment in Bitcoin. The malware’s name derives from its custom encryption algorithm, which uses a Gosh‑specific cipher based on ChaCha20 and RSA‑4096. According to MITRE ATT&CK, GOSH is associated with techniques including T1486 (Data Encrypted for Impact) and T1490 (Inhibit System Recovery).

🔧 Technical Capabilities

GOSH propagates via spear‑phishing emails containing malicious Microsoft Office attachments that download the payload from a remote C2 server. It uses a PowerShell dropper that executes in memory to avoid disk‑based detection. The ransomware achieves persistence by creating a scheduled task under the name “GoshUpdater” and by modifying registry run keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, GOSH disables Windows Defender, Volume Shadow Copy (VSS) via vssadmin delete shadows /all /quiet, and terminates processes associated with backup software and databases. The C2 infrastructure relies on hard‑coded IP addresses that rotate every 72 hours, using HTTPS with self‑signed certificates to blend into normal traffic. GOSH also employs a custom User‑Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) GoshAgent/1.0. It encrypts files with the extension .gosh and drops a ransom note named !!!_README_GOSH_.txt.

📜 History & Notable Incidents

GOSH’s first major campaign targeted healthcare organizations in the United States in April 2021, resulting in the temporary shutdown of three rural hospitals. In July 2021, a second wave hit small‑to‑medium businesses in the manufacturing sector across Germany and Japan. No known CVEs are directly associated with GOSH; instead, it exploits common vulnerabilities like CVE‑2017‑11882 (Equation Editor) in its phishing attachments. Law enforcement action has not been publicly reported, but the ransomware’s operations reportedly declined after a botched infrastructure migration in late 2022.

🔍 Detection Indicators

Known file hashes include SHA‑256 5c6a9b1f3e8d2c4a7b0e1f5d6c8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f (sample submitted to VirusTotal in 2021). Behavioral indicators include multiple VSS deletion commands within seconds of execution, creation of scheduled task “GoshUpdater”, and outbound HTTPS connections to IP ranges 185.234.73.0/24 and 91.121.147.0/24. Registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunGoshUpdater is created. The mutex named GoshMutex_2021 is used to prevent multiple instances. Network IOCs include user‑agent strings containing “GoshAgent”.

☠️ Risk & Impact

GOSH can encrypt critical files across network shares and local drives, causing significant operational disruption and data loss. The 2021 attacks on healthcare providers led to estimated financial losses of over $2.3 million per incident due to downtime and ransom payments. Affected sectors include healthcare, manufacturing, and education. The malware also exfiltrates system information (hostname, IP, domain) to its C2 before encryption, potentially aiding follow‑on attacks.

🛡️ Mitigation

Defenders should block the execution of macros from untrusted sources, disable the Equation Editor component (MSCOMCTL.OCX) via registry, and enable attack surface reduction rules as recommended by Microsoft. Implement detection rules for VSS deletion (Sysmon Event ID 1 for vssadmin.exe) and scheduled task creation (Event ID 4698). Regular offline backups and user awareness training against phishing remain essential countermeasures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.