G0115 GOLD SOUTHFIELD
EnterpriseICSalso known asGOLD SOUTHFIELD · Pinchy Spider
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.
01
canonical actor
The group this is attributed to.
02
techniques used (9)
ATT&CK techniques this enables or maps to.
03
software used (2)
Malware and tools associated with this.
04
Detected by (Sigma) (1)
Sigma detection rules related to this.
05
source
Where this definition is published.