Threat Group Cards: A Threat Actor Encyclopedia

Other threat group: Lunar Spider

Names	Lunar Spider (CrowdStrike) Gold SwathMore (SecureWorks)
Country	Russia
Motivation	Financial crime
First seen	2019
Description	Lunar Spider is reportedly associated with Wizard Spider, Gold Blackburn. (CrowdStrike) On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by Lunar Spider) proxy module in conjunction with TrickBot (developed and operated by Wizard Spider), which may provide Wizard Spider with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors. BokBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542) and Smoke Loader (operated by Smoky Spider). BokBot itself has been observed to distribute TrickBot (Wizard Spider, Gold Blackburn) and TinyLoader (Tiny Spider).
Observed	Sectors: Financial. Countries: Worldwide.
Tools used	BokBot, Vawtrak.
Information	<https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/> <https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/>

Last change to this card: 07 January 2021

Download this actor card in PDF or JSON format