ETDA ThaiCERT
Report
Search
Home > List all groups > Lunar Spider

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Other threat group: Lunar Spider

NamesLunar Spider (CrowdStrike)
CountryRussia Russia
MotivationFinancial crime
First seen2019
DescriptionLunar Spider is reportedly associated with Wizard Spider, Gold Blackburn.

(CrowdStrike) On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by Lunar Spider) proxy module in conjunction with TrickBot (developed and operated by Wizard Spider), which may provide Wizard Spider with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors.

BokBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542) and Smoke Loader (operated by Smoky Spider).

BokBot itself has been observed to distribute TrickBot (Wizard Spider, Gold Blackburn) and TinyLoader (Tiny Spider).
ObservedSectors: Financial.
Countries: Worldwide.
Tools usedBokBot, Vawtrak.
Information<https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/>
<https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/>

Last change to this card: 15 April 2020

Download this actor card in PDF or JSON format

Previous: Infraud Organization
Next: Monty Spider

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key