Trusted Design

GOLD SOUTHFIELD

アクターID: G0115

· MITRE Pageへのリンク

脅威アクターの詳細

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)

脅威アクターの別名・別称

GOLD SOUTHFIELD
Pinchy Spider

利用した攻撃手法

• T1156 - Malicious Shell Modification
• T1123 - Audio Capture
• T1140 - Deobfuscate/Decode Files or Information
• T1586.002 - Email Accounts
• T1497.002 - User Activity Based Checks
• T1122 - Component Object Model Hijacking
• T1562.013 - Disable or Modify Network Device Firewall
• T1573 - Encrypted Channel
• T1601.001 - Patch System Image

関連するCVE (攻撃手法に関連)

• CVE-2013-3906 (T1601.001)
• CVE-2014-4114 (T1601.001)
• CVE-2015-5119 (T1140)
• CVE-2015-5122 (T1140)
• CVE-2012-1856 (T1601.001)
• CVE-2015-2545 (T1140)
• CVE-2015-7645 (T1140)
• CVE-2017-0199 (T1601.001)
• CVE-2015-3043 (T1140)
• CVE-2015-3090 (T1140)
• CVE-2015-3113 (T1140)
• CVE-2015-2590 (T1140)
• CVE-2015-2424 (T1140)
• CVE-2015-0097 (T1140)
• CVE-2012-0158 (T1586.002)
• CVE-2014-1761 (T1140)
• CVE-2015-2502 (T1140)
• CVE-2014-6271 (T1140)
• CVE-2013-2094 (T1140)
• CVE-2016-1010 (T1140)
• CVE-2016-1019 (T1140)
• CVE-2016-0984 (T1140)
• CVE-2016-1001 (T1140)
• CVE-2016-0998 (T1140)
• CVE-2015-1641 (T1140)
• CVE-2015-1701 (T1140)
• CVE-2015-0313 (T1140)
• CVE-2015-0359 (T1140)
• CVE-2015-5130 (T1140)
• CVE-2015-5134 (T1140)
• CVE-2015-5539 (T1140)
• CVE-2015-5557 (T1140)
• CVE-2015-5563 (T1140)
• CVE-2015-5559 (T1140)
• CVE-2015-5540 (T1140)
• CVE-2015-5561 (T1140)
• CVE-2015-5551 (T1140)
• CVE-2015-5564 (T1140)
• CVE-2015-5565 (T1140)
• CVE-2015-5550 (T1140)
• CVE-2015-5566 (T1140)
• CVE-2015-5127 (T1140)
• CVE-2015-5556 (T1140)
• CVE-2015-3628 (T1140)
• CVE-2016-1898 (T1140)
• CVE-2016-1897 (T1140)
• CVE-2016-1287 (T1140)
• CVE-2015-7261 (T1140)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1140)
• CVE-2017-0261 (T1140)
• CVE-2017-0262 (T1140)
• CVE-2016-9494 (T1140)
• CVE-2025-55182 (T1140)
• CVE-2015-0311 (T1140)
• CVE-2015-0932 (T1140)
• CVE-2012-0056 (T1140)
• CVE-2010-3081 (T1140)
• CVE-2010-3333 (T1140)
• CVE-2015-0336 (T1140)
• CVE-2014-3153 (T1140)
• CVE-2014-4322 (T1140)
• CVE-2015-3636 (T1140)
• CVE-2013-6282 (T1140)
• CVE-2015-3105 (T1140)
• CVE-2014-0497 (T1140)
• CVE-2017-16929 (T1140)
• CVE-2013-0074 (T1140)
• CVE-2012-0507 (T1140)
• CVE-2014-8439 (T1140)
• CVE-2013-2551 (T1140)
• CVE-2014-0569 (T1140)
• CVE-2014-0515 (T1140)
• CVE-2015-0310 (T1140)
• CVE-2014-1776 (T1140)
• CVE-2014-0556 (T1140)
• CVE-2012-1876 (T1140)
• CVE-2015-5560 (T1140)
• CVE-2012-2539 (T1140)
• CVE-2014-9163 (T1140)
• CVE-2012-1723 (T1140)
• CVE-2014-8440 (T1140)
• CVE-2010-0806 (T1140)
• CVE-2010-1297 (T1140)
• CVE-2010-2884 (T1140)
• CVE-2011-3402 (T1140)
• CVE-2010-2883 (T1140)
• CVE-2013-0634 (T1140)
• CVE-2014-7247 (T1140)
• CVE-2013-2595 (T1140)
• CVE-2015-4902 (T1140)
• CVE-2011-0611 (T1140)
• CVE-2013-5990 (T1140)
• CVE-2016-0189 (T1601.001)
• CVE-2017-0143 (T1586.002)
• CVE-2023-1389 (T1140)
• CVE-2025-24893 (T1140)
• CVE-2025-34026 (T1140)
• CVE-2025-55183 (T1140)
• CVE-2025-55184 (T1140)
• CVE-2015-1770 (T1601.001)
• CVE-2012-4969 (T1601.001)
• CVE-2014-6352 (T1601.001)
• CVE-2008-1436 (T1122)
• CVE-2014-6332 (T1601.001)
• CVE-2014-0322 (T1601.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る