- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial gain
- Seen
- 2020
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0339 · riddle-spider
What it is
According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Riddle Spider
- Other names
- Avaddon Team
Targets
- Countries
- Australia, Belgium, Brazil, Canada, China, Costa Rica, Czech, France, Germany, India, Indonesia, Italy, Japan, Jordan, Peru, Poland, Portugal, Russia, South Korea, Spain, Switzerland, Thailand, United Arab Emirates, United Kingdom, United States
Tools
The tools and malware families the sources tie to it.
- Avaddon
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de