MITRE ATT&CKgroup
G0115 GOLD SOUTHFIELD
- Domain
- enterprise, ics
- Aliases
- Pinchy Spider
- Version
- 2.0
- Created
- 2020-09-22
Description
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.
Related
Uses · MITRE ATT&CK (11)
- T1027.010 Command Obfuscation sub-technique
- S0591 ConnectWise software (tool)
- S0496 REvil software (malware)
- T1195.002 Compromise Software Supply Chain sub-technique
- T1059.001 PowerShell sub-technique
- T1566 Phishing technique
- T1190 Exploit Public-Facing Application technique
- T1199 Trusted Relationship technique
- T1219 Remote Access Tools technique
- T1113 Screen Capture technique
- T1133 External Remote Services technique
References
- https://www.secureworks.com/research/revil-sodinokibi-ransomware Secureworks REvil September 2019
- https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/ CrowdStrike Evolution of Pinchy Spider July 2021
- https://www.secureworks.com/blog/revil-the-gandcrab-connection Secureworks GandCrab and REvil September 2019
- https://www.secureworks.com/research/threat-profiles/gold-southfield Secureworks GOLD SOUTHFIELD