Loading threat actor…
GOLD SOUTHFIELD, also known as GOLD SOUTHFIELD under the compact spelling GoldSouthfield and as PINCHY SPIDER, is a financially motivated cybercriminal threat group associated with deployment of Sodinokibi ransomware, also known as REvil or Sodin. Its documented activity includes Sodinokibi use in September 2019. The group obtains initial access by exploiting vulnerabilities in public-facing Oracle WebLogic applications and accessing publicly exposed Remote Desktop Protocol and remote monitoring and management servers. It has also conducted software supply-chain compromise, distributing ransomware through backdoored software installers after compromising the website distributing the Italian version of WinRAR. On compromised systems, GOLD SOUTHFIELD stages and executes PowerShell scripts, including Base64-encoded scripts that obscure their contents. It has abused the legitimate ConnectWise remote monitoring and management tool to capture screenshots from victim machines.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
62 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
11 CVEs Mallory has associated with this actor across public reporting. 11 of them are exploited in the wild (not necessarily by this actor).
5 more CVEs tied to this actor tracked in Mallory.
19 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.