GOLD NORTHFIELD is a financially motivated cybercriminal group known for repurposing REvil ransomware as "LV ransomware".
GOLD NORTHFIELD is a financially motivated cybercriminal group active since at least October 2020. They leverage GOLD SOUTHFIELD's REvil ransomware by replacing its configuration with their own, creating a variant they call 'LV ransomware'. No specific target information was provided, but their primary TTP involves repurposing existing ransomware for their operations. Defenders should focus on detecting REvil indicators, particularly configuration changes, and monitor for anomalous file encryption activities across the network.
Operational since at least October 2020, GOLD NORTHFIELD is a financially motivated cybercriminal threat group that leverages GOLD SOUTHFIELD's REvil ransomware in their attacks. To do this, the threat actors replace the configuration of the REvil ransomware binary with their own in an effort to repurpose the ransomware for their operations. GOLD NORTHFIELD has given this modified REvil ransomware variant the name 'LV ransomware'.
GOLD NORTHFIELD modifies the configuration of GOLD SOUTHFIELD's REvil ransomware to create their own variant called 'LV ransomware' for use in their operations.
Defenders should focus on detecting known REvil indicators, particularly configuration file changes, and monitor for anomalous file encryption activities across the network.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.