- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(medium confidence)
- Motivation
- Financial gain
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0115 · 9 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0204 · gold-southfield
RussiaWhat it is
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Pinchy Spider
- MITRE ATT&CK
- G0115
- Other names
- GOLD GARDEN, Pinchy Spider, Gold Southfield
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- ConnectWise
- Cyber Eye RAT
- CyberGate
- PinchDuke
- REvil
- Unknown Logger
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de