GINC-APT-0272 · Criminal

BITWISE SPIDER

Also LockBit Gang, Gold Mystic, Operation “Cronos”, White Janus.

Category: Criminal · Financially motivated: ransomware, fraud and theft.
Origin: Unknown
Motivation: Financial gain
Seen: 2019
Sources: 6 sources carry it
Identifier: GINC-APT-0272 · bitwise-spider

What it is

BITWISE SPIDER has recently and quickly become a significant player in the big game hunting (BGH) landscape. Their dedicated leak site (DLS) has received the highest number of victims posted each month since July 2021 compared to other adversary DLSs due to the growing popularity and effectiveness of LockBit 2.0.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

PwC: White Janus
Operations: Operation “Cronos”
Other names: LockBit Gang, Gold Mystic

Targets

Sectors: Aviation, Defense, Energy, Financial, Healthcare, Transportation

Tools

The tools and malware families the sources tie to it.

3AM
CrackMapExec
EmpireProject
LockBit
Mimikatz
PsExec

Sources

ETDA Threat Group Card apt.etda.or.th
Malpedia malpedia.caad.fkie.fraunhofer.de