- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0433 · overlord-spider
What it is
OVERLORD SPIDER, aka The Dark Overlord. Similar to ransomware operators today, OVERLORD SPIDER likely purchased RDP access to compromised servers on underground forums in order to exfiltrate data from corporate networks. The actor was known to attempt to “sell back” the data to the respective victims, threatening to sell the data to interested parties should the victim refuse to pay. There was at least one identified instance of OVERLORD SPIDER successfully selling victim data on an underground market.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Overlord Spider
- Other names
- TheDarkOverlord, The Dark Overlord
Tools
The tools and malware families the sources tie to it.
- Dark DDoSeR
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de