- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime
- Seen
- 2019
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0132 · lunar-spider
RussiaWhat it is
According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections. On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in conjunction with TrickBot (developed and operated by WIZARD SPIDER), which may provide WIZARD SPIDER with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors. Lunar Spider is reportedly associated withGrim Spider and Wizard Spider.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Lunar Spider
- Other names
- Gold SwathMore
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Sectors
- Financial
Tools
The tools and malware families the sources tie to it.
- BokBot
- IcedID (BokBot)
- Vawtrak
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de