FORENSIA

THREAT_ACTOR · G0115

GOLD SOUTHFIELD

Also known as: GOLD SOUTHFIELD, Pinchy Spider

Profile

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.

MITRE ATT&CK ↗

Techniques

9 ATT&CK techniques attributed to this actor.

T1027.010 Command ObfuscationT1059.001 PowerShellT1113 Screen CaptureT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1219 Remote Access ToolsT1566 Phishing

Software

2 malware/tools attributed to this actor.

REvilConnectWise

Related corpus activity

9,245 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to GOLD SOUTHFIELD.

IndicatorTypeFamilySevSrc
cve-2020-22653cve—852
cve-2025-61155cveransomware853
cve-2025-68670cve—852
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-7852cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2024-1781cve—851
cve-2026-3102cve—853
cve-2020-22658cve—852
cve-2021-29441cve—851
cve-2025-12057cve—851
cve-2025-7443cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2025-34054cve—854
cve-2016-5681cve—852
cve-2018-8007cve—851
cve-2025-23304cve—852
cve-2022-47945cve—851
cve-2025-2492cve—852
cve-2026-4368cveransomware851
cve-2026-0740cve—851
cve-2026-3844cve—851
cve-2025-34085cve—851
cve-2023-52271cveransomware853

Showing the top 30 by severity of 9,245.