GINC Technology
GINC-APT-0278 · Criminal

CIRCUS SPIDER

Also Circus Spider.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Russia(high confidence)
Motivation
Financial gain
Seen
2019
Sources
6 sources carry it
Identifier
GINC-APT-0278 · circus-spider

What it is

According to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIRCUS SPIDER. Initially discovered in September 2019and havinga compilation timestamp dating back to 28 August 2019, NetWalker has been found to be used in Big Game Hunting (BGH)-style operations while also being distributed via spam. CIRCUS SPIDER is advertising NetWalkeras being a closed-affiliate program,and verifies applicants before they are being accepted as an affiliate. The requirements rangefrom providing proof of previous revenue in similar affiliates programs, experience in the field and what type of industry the applicantis targeting.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Circus Spider

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, China, Colombia, France, Germany, Guatemala, Hungary, India, Iran, Ireland, Italy, Luxembourg, Malaysia, Netherlands, New Zealand, Nicaragua, Nigeria, Norway, Pakistan, Poland, Russia, Saudi Arabia, South Africa, Spain, Sweden, Thailand, Ukraine, United States, Vietnam
Sectors
Education, Energy, Government, Healthcare, Manufacturing, Shipping and Logistics, Transportation

Tools

The tools and malware families the sources tie to it.

  • Back Orifice
  • Back Orifice 2000
  • NetWalker
  • Revenge-RAT

Sources