GINC-APT-0375 · Criminal

Alpha Spider

Also Velvet Tempest, ALPHV Ransomware Group, DEV-0504.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Unknown
Sources
5 sources carry it
Identifier
GINC-APT-0375 · alpha-spider

What it is

ALPHA SPIDER is a threat actor known for developing and operating the Alphv ransomware as a service. They have been observed using novel offensive techniques, such as exploiting software vulnerabilities and leveraging legitimate administration tools for malicious activities. ALPHA SPIDER affiliates have demonstrated persistence in exfiltrating data and have shown the ability to bypass security measures like DNS-based filtering and multifactor authentication. Despite lacking specific operational security measures, defenders have opportunities to detect and respond to ALPHA SPIDER's operations effectively.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Microsoft
Velvet Tempest, DEV-0504
Other names
ALPHV Ransomware Group

Tools

The tools and malware families the sources tie to it.

  • BLACKCOFFEE
  • BlackEnergy
  • BlackHole
  • BlackNix
  • Blackshades
  • Cobalt Strike
  • Offence
  • Virus RAT
  • Xploit

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de