- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime
- Seen
- 2011
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0240 · shark-spider
RussiaWhat it is
This group's activity was first observed in November 2013. It leverages a banking Trojan more commonly known as Shylock which aims to compromise online banking credentials and credentials related to Bitcoin wallets.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Shark Spider
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- ThreatActor.info (Malpedia et al.)Russia
Targets
- Sectors
- Bank, Financial
Tools
The tools and malware families the sources tie to it.
- Shylock
- Trojan.Karagany
- Trojan.Mebromi
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de