GOLD SOUTHFIELD
- ID
- G0115
- Associated names
- Pinchy Spider
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.[1][2][3][4]
Techniques used (9)
- T1027.010 Command Obfuscation
- T1059.001 PowerShell
- T1113 Screen Capture
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1219 Remote Access Tools
- T1566 Phishing