Eldorado Ransomware: The New Golden Empire of Cybercrime?

This report from Group-IB profiles the Eldorado ransomware: a Golang-based, cross-platform (Windows/Linux) ransomware with ChaCha20 file encryption and RSA-OAEP key wrapping, distributed via an affiliate/locker-builder model advertised on underground forums; the analysis details builder parameters, SMB network propagation, cleanup routines, victim statistics (16 companies across multiple industries), several SHA256 file IOCs, and remediation/mitigation recommendations.