Threat intelligence / Group

GOLD SOUTHFIELD

[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)

11 recorded

Relationships

uses

to Command Obfuscation

Technique

uses

to Compromise Software Supply Chain

Technique

uses

Tool

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

Technique

uses

Technique

uses

to Remote Access Tools

Technique

uses

Malware

uses

to Screen Capture

Technique

uses

to Trusted Relationship

Technique

6 external

References

mitre-attack

G0115

Pinchy Spider

—

Secureworks REvil September 2019

https://www.secureworks.com/research/revil-sodinokibi-ransomware

CrowdStrike Evolution of Pinchy Spider July 2021

https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/

Secureworks GandCrab and REvil September 2019

https://www.secureworks.com/blog/revil-the-gandcrab-connection

Secureworks GOLD SOUTHFIELD

https://www.secureworks.com/research/threat-profiles/gold-southfield