threat actor

GOLD SOUTHFIELD

unknownentity:threat_actor

GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. GOLD SOUTHFIELD is responsible for authoring REvil and operating the backend infrastructure used by affiliates (also cal

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: gold-southfield
kind: threat actor
status: unknown
aliases: Pinchy Spider · PINCHY SPIDER
jurisdictions: —
claims naming it: 0 · 0 attributions · 1 relations · 0 events

Identifiers

attack G0115via mitre-attack
misp-galaxy 262c8537-1cdb-4297-aa3e-1410164160bfvia misp-galaxy-threat-actor
misp-galaxy 80f07c15-cad3-44a2-a8a4-dd14490b5117via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatGOLD SOUTHFIELDusesREvil
fetch —sha256 dc1639caa5501d72
rel_543btcintel:relations:543@v1 sha256:60e2ffa70bb82386
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.