{
  "id": "gold-southfield",
  "name": "GOLD SOUTHFIELD",
  "aliases": [
    "Pinchy Spider"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Operator of REvil ransomware-as-a-service",
      "src": [
        "mitre-g0115"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2018,
      "src": [
        "mitre-g0115"
      ],
      "conf": "medium",
      "note": "At least 2018"
    },
    {
      "k": "attack_id",
      "v": "G0115",
      "src": [
        "mitre-g0115"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 9,
      "src": [
        "mitre-g0115"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ConnectWise, REvil",
      "src": [
        "mitre-g0115"
      ],
      "conf": "high",
      "note": "2 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0115)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/gold-southfield.html",
  "sources": {
    "mitre-g0115": {
      "title": "GOLD SOUTHFIELD, Group G0115",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0115/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}