GOLD SOUTHFIELD
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.
- ATT&CK ID
- G0115
- Techniques
- 9
- Tools
- 2
Also tracked as Pinchy Spider
Techniques
Initial Access
External Remote ServicesExploit Public-Facing ApplicationSupply Chain CompromiseTrusted RelationshipPhishing
Execution
Command and Scripting Interpreter
Persistence
Stealth
Obfuscated Files or Information
Collection
Command and Control
Software
ConnectWise · REvil