Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

GOLD SOUTHFIELD

1 incidentes 1 paises 1 sectores threat-actor RU Ultimo: 2026-05-25

Aliases: Pinchy Spider

Ver en IntelTracker → APTTrail →

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.

Aliases del actor

Pinchy Spider

Actores similares

pinchy-spideractor · 1 PINCHY SPIDERapt · 0 Scattered Spiderthreat-actor · 2 doppel-spideractor · 1 salty-spideractor · 1 brain-spideractor · 1 skeleton-spideractor · 1 bamboo-spideractor · 1 andromeda-spideractor · 1 cobalt-spideractor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

Tipo	Estado	Host / enlace	Title / ultimo titulo
Web	unknown	attack.mitre.org	OSINT

Motivacion

Financial gain

Malware asociado

REvil

Tecnicas MITRE

T1219, T1045 - Software Packing, T1486, T1069 - Permission Groups Discovery, T1195.002, T1553.002 - Code Signing

CVEs relacionadas

CVE-2018-0802

Victimas

TTPs unicas

Info robada historica

N/D

Rescates reclamados

N/D

Pagos detectados

N/D

Paises afectados

United States (1)

Sectores atacados

Software (1)

Sectores objetivo (OSINT)

HealthCare & Social AssistanceInternet PublishingPerforming Arts CompaniesComputer Systems Design and Related ServicesNational Security