GOLD SOUTHFIELD
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
GOLD SOUTHFIELD is a financially motivated cybercriminal threat group that authors and operates the REvil (aka Sodinokibi) ransomware on behalf of various affiliated threat groups. Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. GOLD SOUTHFIELD is responsible for authoring REvil and operating the backend infrastructure used by affiliates (also called partners) to create malware builds and to collect ransom payments from victims. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.secureworks.com/research/revil-sodinokibi-ransomware
https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic
https://www.secureworks.com/blog/revil-the-gandcrab-connection