Introduction
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked. Secureworks REvil September 2019 Secureworks GandCrab and REvil September 2019 Secureworks GOLD SOUTHFIELD CrowdStrike Evolution of Pinchy Spider July 2021
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1113 Screen Capture
- T1219 Remote Access Tools
- T1195.002 Compromise Software Supply Chain
- T1027.010 Command Obfuscation
- T1133 External Remote Services
- T1059.001 PowerShell
- T1566 Phishing
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- CyberGate
- Cyber Eye RAT
- Archelaus Beta
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [3] Secureworks REvil September 2019 Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020. [4] CrowdStrike Evolution of Pinchy Spider July 2021 Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023. [5] Secureworks GandCrab and REvil September 2019 Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020. [6] Secureworks GOLD SOUTHFIELD Secureworks. (n.d.). GOLD SOUTHFIELD. Retrieved October 6, 2020.