- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial crime
- Seen
- 2018
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0168 · anthropoid-spider
What it is
Publicly known as 'EmpireMonkey', ANTHROPOID SPIDER conducted phishing campaigns in February and March 2019, spoofing French, Norwegian and Belizean financial regulators and institutions. These campaigns used macro-enabled Microsoft documents to deliver the PowerShell Empire post-exploitation framework. ANTHROPOID SPIDER likely enabled a breach that allegedly involved fraudulent transfers over the SWIFT network.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- EmpireMonkey, CobaltGoblin, Empire Monkey, EmpireMonkey, CobaltGoblin
Targets
- Countries
- Malta
- Sectors
- Finance, Financial
Tools
The tools and malware families the sources tie to it.
- MedusaLocker
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de