MITRE Shield will be retired on October 18th in favor of MITRE Engage. To learn more, click here.
  1. Home
    2.  > ATT&CK Groups Overview

Mapping To GOLD SOUTHFIELD

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2019 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments.


Disclaimer: We present this mapping to stimulate thinking about active defense options to combat this adversary, not to present all possibilities. We invite you to use this as a guide and add your own use cases for applying Shield techniques to counter each adversary action.

Note: All ATT&CK Group sub-technique mappings have been remapped to their parent technique and were derived from Group Technique mappings in ATT&CK v8.

Details
ATT&CK ID: G0115
Associated Groups:  GOLD SOUTHFIELD
Note:  This page uses Adversary Group data from MITRE ATT&CK.
ATT&CK Technique Opportunity Space AD Technique Use Case
T1133 - External Remote Services There is an opportunity to determine if an adversary already has valid account credentials for your network and if they are trying to use them access your network via remote services. DTE0017 - Decoy System A defender can setup a decoy VPN server and see if an adversary attempts to use valid account to authenticate to it.
T1190 - Exploit Public-Facing Application There is an opportunity to deploy a tripwire that triggers an alert when an adversary touches a network resource or uses a specific technique. DTE0017 - Decoy System A defender can use decoy system running a public-facing application to see if an adversary attempts to compromise the system and learn their TTPs.
T1190 - Exploit Public-Facing Application There is an opportunity to present several public-facing application options to see what application(s) the adversary targets. DTE0013 - Decoy Diversity A defender can use a diverse set of decoy systems to study an adversary and determine which types of public-facing applications they choose to exploit.
T1195 - Supply Chain Compromise Hardware and/or software additions can be tested and verified in controlled environments prior to deployment. DTE0014 - Decoy Network A defender can install any suspect hardware or software on an isolated system or network and monitor for non-standard behaviors.
T1199 - Trusted Relationship When authorized behavior is defined and limited for trusted partners, adversaries exploiting trust relationships are easier to detect. DTE0034 - System Activity Monitoring Defenders can monitor trusted partner access, detecting unauthorized activity.
T1566 - Phishing A phishing email can be detected and blocked from arriving at the intended recipient. DTE0019 - Email Manipulation A defender can intercept emails that are detected as suspicious or malicious by email detection tools and prevent deliver to the intended target.
T1566 - Phishing A phishing email can be detected and moved from the intended recipient to a decoy account for reading and execution. DTE0023 - Migrate Attack Vector A defender can move suspicious emails to a decoy system prior to opening and examining the email.
T1566 - Phishing Users trained and encouraged to report phishing can detect attacks that other defenses do not. DTE0035 - User Training A program to train and exercise the anti-phishing skills of users can create "Human Sensors" that help detect phishing attacks.
T1566 - Phishing There is an opportunity to discover who or what is being targeting by an adversary. DTE0015 - Decoy Persona A defender can seed information about the decoy persona's personal accounts on systems to see if the adversary collects and uses that information in future activity.