- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial crime
- Seen
- 2015
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0175 · boson-spider
What it is
BOSON SPIDER is a cyber criminal group, which was first identified in 2015, recently and inexplicably went dark in the spring of 2016, appears to be a tightly knit group operating out of Eastern Europe. They have used a variety of distribution mechanisms such as the infamous (and now defunct) angler exploit kit, and obfuscated JavaScript to reduce the detection by antivirus solutions.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Boson Spider
Targets
- Countries
- Australia, Canada, Japan, United Kingdom, United States
- Sectors
- Financial
Tools
The tools and malware families the sources tie to it.
- CoreBot
- Cyber Eye RAT
- CyberGate
- Dark DDoSeR
- Virus RAT
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de