GOLD SOUTHFIELD

Gold Southfield is a threat actor group known for its malicious cyber activities. Secureworks® Counter Threat Unit™ (CTU) researchers have found significant overlaps in the code structure of LV ransomware and REvil, a ransomware operated by Gold Southfield. This suggests that Gold Southfield may have sold or shared the source code, or it could have been stolen. Furthermore, similarities between REvil and GandCrab ransomware suggest a connection between Gold Southfield and another threat group, Gold Garden. Gold Southfield has also been linked to the distribution of Sodinokibi ransomware through ScreenConnect/ConnectWise, highlighting their use of remote desktop management software for their operations. In 2020, unauthorized manipulation of REvil by another threat group, Gold Northfield, was observed. This action is likely to prompt Gold Southfield to implement additional anti-tamper controls and modify configuration storage and processing to prevent future tampering attempts. Gold Southfield's methods appear to be adopted by Gold Northfield, including the tracking of individual Ransomware-as-a-Service (RaaS) partners and campaigns. Despite announcing the cessation of its RaaS operation, Gold Southfield did not indicate refraining from deploying ransomware, implying continued threats. In March 2021, a member of Gold Southfield hinted at a shift in their target selection strategy. They suggested that future victims would be identified by targeting cyber insurance providers and identifying their customers. This new approach shows an evolution in their tactics and a potential increase in threat level. Gold Southfield, along with other groups like Gold Waterfall, has accepted cryptocurrencies like Bitcoin and Monero as ransom payments in the past, further complicating the tracking and prosecution of these threat actors.