CVE Intelligence
Home / Threat actors / GOLD SOUTHFIELD

GOLD SOUTHFIELD G0115

🔔 Create alert

Also known as: Pinchy Spider

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
10
Techniques
2
Malware and tools

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.

Ransomware operations linked to this group ransomware.live

revil via REvil

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Initial Access
T1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1199 Trusted RelationshipT1566 Phishing
Execution
T1059.001 PowerShell
Persistence
T1133 External Remote Services
Stealth
T1027.010 Command Obfuscation
Collection
T1113 Screen Capture
Command and Control
T1219 Remote Access Tools

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.