Demon Spider


DEMON SPIDER primarily develops and sells downloaders. Currently, the adversary focuses on marketing the two-stage downloader Matanbuchus in a server-rental model. DEMON SPIDER provisions a server for the affiliate and provides a control panel from which the affiliate can interact with the compromised hosts. DEMON SPIDER provides customer-specific builds of the first and main stages and instructs ...

Community Identifiers



  • norPUgZM9Bvz4ah


  • zeEdVgnK

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.