GOLD SOUTHFIELD
Also known as Pinchy Spider
GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. GOLD SOUTHFIELD is responsible for authoring REvil and operating the backend infrastructure used by affiliates (also called partners) to create malware builds and to collect ransom payments from victims. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
No posts or advisories have named this actor recently.
References
- http://www.secureworks.com/research/threat-profiles/gold-southfield
- https://www.secureworks.com/research/revil-sodinokibi-ransomware
- https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic
- https://www.secureworks.com/blog/revil-the-gandcrab-connection
- https://attack.mitre.org/groups/G0115
- https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/
- https://www.secureworks.com/research/threat-profiles/gold-southfield
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.