SYMBOLCOMMON_NAMEaka. SYNONYMS

GOLD SOUTHFIELD  (Back to overview)


GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. GOLD SOUTHFIELD is responsible for authoring REvil and operating the backend infrastructure used by affiliates (also called partners) to create malware builds and to collect ransom payments from victims. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates.


Associated Families

There are currently no families associated with this actor.


References
2021SecureworksSecureWorks
@online{secureworks:2021:threat:c3f3903, author = {SecureWorks}, title = {{Threat Profile: GOLD SOUTHFIELD}}, date = {2021}, organization = {Secureworks}, url = {http://www.secureworks.com/research/threat-profiles/gold-southfield}, language = {English}, urldate = {2021-05-28} } Threat Profile: GOLD SOUTHFIELD
REvil GOLD SOUTHFIELD
2020-04-08SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20200408:how:192d583, author = {Counter Threat Unit ResearchTeam}, title = {{How Cyber Adversaries are Adapting to Exploit the Global Pandemic}}, date = {2020-04-08}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic}, language = {English}, urldate = {2021-05-28} } How Cyber Adversaries are Adapting to Exploit the Global Pandemic
GOLD SOUTHFIELD TA2101 TA505 WIZARD SPIDER
2019-09-24SecureworksCTU Research Team
@online{team:20190924:revilsodinokibi:646c88c, author = {CTU Research Team}, title = {{REvil/Sodinokibi Ransomware}}, date = {2019-09-24}, organization = {Secureworks}, url = {https://www.secureworks.com/research/revil-sodinokibi-ransomware}, language = {English}, urldate = {2020-01-08} } REvil/Sodinokibi Ransomware
REvil GOLD SOUTHFIELD
2019-09-24SecureworksCTU Research Team
@online{team:20190924:revil:3f165f3, author = {CTU Research Team}, title = {{REvil: The GandCrab Connection}}, date = {2019-09-24}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/revil-the-gandcrab-connection}, language = {English}, urldate = {2020-01-08} } REvil: The GandCrab Connection
REvil GOLD SOUTHFIELD

Credits: MISP Project