GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.1234
- Secureworks REvil September 2019
- Secureworks GandCrab and REvil September 2019
- Secureworks GOLD SOUTHFIELD
- CrowdStrike Evolution of Pinchy Spider July 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | GOLD SOUTHFIELD | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Pinchy Spider | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2020 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1027.010 | Command Obfuscation | — |
| T1059.001 | PowerShell | — |
| T1113 | Screen Capture | — |
| T1133 | External Remote Services | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1199 | Trusted Relationship | — |
| T1219 | Remote Access Tools | — |
| T1566 | Phishing | — |
Aliases
GOLD SOUTHFIELD · Pinchy Spider
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.