Threat Actor Profile
Pinchy Spider
Pinchy Spider, also known as Gold Southfield, is a financially motivated cybercriminal group originating from Russia. Active since 2018, they are infamous for developing and operating GandCrab and REvil ransomware under a Ransomware-as-a-Service (RaaS) model. Their operations focus on high-value targets using advanced tactics like lateral movement and data exfiltration.
Threat Actor Profile
Pinchy Spider
Country of Origin
Members
Leadership
Pinchy Spider TTPs
Tactics
The primary goal of Pinchy Spider is financial gain through ransomware attacks targeting enterprises and critical infrastructure.
Techniques
-
Exploiting vulnerabilities in public-facing applications (e.g., Oracle WebLogic).
-
Using stolen credentials for lateral movement via RDP.
-
Employing phishing campaigns to gain initial access.
Procedures
-
Deploying GandCrab and REvil ransomware.
-
Utilizing tools like Cobalt Strike and certutil for reconnaissance and persistence.
-
Encrypting individual hosts and demanding per-host ransoms.
Want to Shut Down Threats Before They Start?
Notable Cyberattacks
Pinchy Spider has been linked to several significant cyberattacks:
GandCrab Campaigns (2018-2019): These campaigns targeted enterprises worldwide and generated over $2 billion in ransom payments. The group’s innovative RaaS model allowed affiliates to execute attacks on a large scale.
REvil Operations (2019-2021): Pinchy Spider transitioned to using REvil ransomware, which became one of the most prevalent ransomware tools. High-profile incidents included attacks on managed service providers and critical infrastructure, such as the Colonial Pipeline incident.
Law Enforcement & Arrests
Law enforcement agencies have made significant progress in combating Pinchy Spider and its affiliates:
In 2020, a GandCrab operator was arrested in Belarus, marking a major breakthrough in disrupting the group’s operations.
In 2021, several REvil affiliates were arrested in Romania and Kuwait, further weakening the group’s network.
In 2024, Russian authorities sentenced members of the REvil ransomware group to over four years in prison, demonstrating international efforts to hold cybercriminals accountable.
How to Defend Against Pinchy Spider
Deploy advanced endpoint protection solutions and anti-phishing technologies to detect and block malicious activities.
Regularly patch vulnerabilities in software and systems to prevent exploitation by attackers.
Segment networks to limit the lateral movement of attackers within the environment.
Use Huntress Platform Tools to detect and mitigate ransomware threats effectively, ensuring robust protection against Pinchy Spider’s tactics.
References
Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
