Gold Melody, also known as Prophet Spider or UNC961, is being watched by researchers due to their unique angle in the cybercriminal marketplace as an initial access broker (IAB). The threat actor has been conducting opportunistic attacks since at least 2017 by compromising organizations, exploiting vulnerabilities in unpatched internet-facing servers and then selling access to those compromised organizations for other adversaries to conduct follow-on attacks. Gold Melody has had an expansive victimology footprint ranging from organizations in North America, Northern Europe, and Western Asia, including strikes on the retail, health care, energy, financial transactions, and high-tech sectors. The group has been observed employing cost-effective approaches to gain initial access by using publicly available exploit codes to exploit recently disclosed vulnerabilities. Gold Melody has attacked countless flaws to obtain initial access and is known to employ remote access trojans (RATs) and tunneling tools to execute arbitrary commands, gather system information, and establish a reverse tunnel with a hard-coded IP address. After a successful foothold has been established and persistence is gained, the deployment of ransomware often follows, signaling the presence of the follow-on threat actor. The financially motivated group’s unique position as an IAB that relies on exploiting vulnerabilities of unpatched internet-facing servers for initial access highlights the importance of robust patch management.