Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · GOLD SOUTHFIELD · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

GOLD SOUTHFIELD

  • Pinchy Spider

MITRE G0115 ↗

GOLD SOUTHFIELD — ATT&CK roseGS

attack rose · 9 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. GOLD SOUTHFIELD is responsible for authoring REvil and operating the backend infrastructure used by affiliates (also called partners) to create malware builds and to collect ransom payments from victims. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 6 of 15 tactics

  1. Initial access

    4 techniques

  2. Execution

    1 technique

  3. Persistence

    1 technique

  4. Stealth

    1 technique

  5. Collection

    1 technique

  6. Command and control

    1 technique

select a technique

Arsenal

1 malware · 1 tools
Malware
Malware · 1ATT&CK
REvilS0496 ↗
Tools
Tools · 1ATT&CK
ConnectWiseS0591 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

7 sources
  1. 1.secureworks.com/research/threat-profiles/gold-southfield
  2. 2.secureworks.com/research/revil-sodinokibi-ransomware
  3. 3.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the…
  4. 4.secureworks.com/blog/revil-the-gandcrab-connection
  5. 5.attack.mitre.org/groups/G0115
  6. 6.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spid…
  7. 7.secureworks.com/research/threat-profiles/gold-southfield

Track GOLD SOUTHFIELD on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.