GOLD SOUTHFIELD
[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)
Properties
- stix_id
- intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133
- signal_observed_at
- 2026-09-11T17:55:00+00:00
- type
- intrusion-set
MITRE ATT&CK Techniques (9)
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishi
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools crea
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality m
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses
Software & Tools (2)
[ConnectWise](https://attack.mitre.org/software/S0591) is a legitimate remote administration tool that has been used since at least 2016 by threat act
[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/
Explore this actor's full graph with Ninja Signal