Threat Group Cards: A Threat Actor Encyclopedia

Other threat group: Shark Spider

Names	Shark Spider (CrowdStrike)
Country	Russia
Motivation	Financial crime
First seen	2011
Description	(Kaspersky) Recently Kaspersky Lab has contributed to an alliance of law enforcement and industry organizations, to undertake measures against the internet domains and servers that form the core of an advanced cybercriminal infrastructure that uses the Shylock Trojan to attack online banking systems around the globe. Shylock is a banking Trojan that was first discovered in 2011. It utilizes man-in-the-browser attacks designed to pilfer banking login credentials from the PCs of clients of a predetermined list of target organizations. Most of these organizations are banks, located in different countries.
Observed	Sectors: Financial. Countries: Worldwide.
Tools used	Shylock.
Operations performed	Jan 2013	New Version of Shylock Malware Spreading Through Skype <https://threatpost.com/new-version-shylock-malware-spreading-through-skype-011713/77416/>
Counter operations	Jul 2014	Global action targeting Shylock malware <https://www.europol.europa.eu/newsroom/news/global-action-targeting-shylock-malware>
Information	<https://securelist.com/shylockcaphaw-malware-trojan-the-overview/64599/>

Last change to this card: 14 April 2020

Download this actor card in PDF or JSON format