- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0375 · alpha-spider
What it is
ALPHA SPIDER is a threat actor known for developing and operating the Alphv ransomware as a service. They have been observed using novel offensive techniques, such as exploiting software vulnerabilities and leveraging legitimate administration tools for malicious activities. ALPHA SPIDER affiliates have demonstrated persistence in exfiltrating data and have shown the ability to bypass security measures like DNS-based filtering and multifactor authentication. Despite lacking specific operational security measures, defenders have opportunities to detect and respond to ALPHA SPIDER's operations effectively.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Velvet Tempest, DEV-0504
- Other names
- ALPHV Ransomware Group
Tools
The tools and malware families the sources tie to it.
- BLACKCOFFEE
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- Cobalt Strike
- Offence
- Virus RAT
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de