- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Iran(high confidence)
- Motivation
- Financial gain
- Seen
- 2015
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0176 · boss-spider
IranWhat it is
Throughout 2018, CrowdStrike Intelligence tracked BOSS SPIDER as it regularly updated Samas ransomware and received payments to known Bitcoin (BTC) addresses. This consistent pace of activity came to an abrupt halt at the end of November 2018 when the U.S. DoJ released an indictment for Iran-based individuals Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, alleged members of the group.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Boss Spider
- Secureworks
- CTG-0007
- Other names
- Boss Spider, Gold Lowell, Gold Lowell
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Sectors
- Education, Government, Healthcare
Tools
The tools and malware families the sources tie to it.
- Mimikatz
- PsExec
- SDelete
- SamSam
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de