- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial crime; Financial gain
- Seen
- 2017
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0576 · scully-spider
What it is
Mentioned as operator of DanaBot in CrowdStrike's 2020 Report.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Scully Spider
- Proofpoint
- TA547
- Other names
- Scully Spider, TA547
Targets
- Countries
- Australia, Austria, Brazil, Canada, Colombia, Germany, Hong Kong, Iraq, Italy, New Zealand, Poland, Spain, Switzerland, Ukraine, United Kingdom, United States
- Sectors
- Financial
Tools
The tools and malware families the sources tie to it.
- Androrat
- DroidJack
- UNITEDRAKE
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de