GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,SaaS,Office 365,Google Workspace|T1566|Phishing|

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.(Citation: Secureworks REvil September 2019)    |