Who is FANCY BEAR (APT28)?
The nation-state adversary group known as FANCY BEAR (also known as APT28 or Sofacy) has been operating since at least 2008 and represents…
Research & Threat Intel
Enhancing Secure Boot Chain on Fedora 29
This blog is from the CrowdStrike Intelligence Advanced Research Team Motivation What is worse than a failing system? A (silently) compromised, yet…
Widespread DNS Hijacking Activity Targets Multiple Sectors
CrowdStrike® Intelligence™ has been researching reports of widespread DNS hijacking activity since information on the attacks became publicly available earlier this month.1 The…
Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware
GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a…
Farewell to Kelihos and ZOMBIE SPIDER
The Kelihos peer-to-peer botnet was one of the largest and longest-operating cybercrime infrastructures in existence. Its origins can be traced back to…
Meet CrowdStrike’s Adversary of the Month for November: HELIX KITTEN
HELIX KITTEN is likely an Iranian-based adversary group, active since at least late 2015, targeting organizations in the aerospace, energy, financial, government,…
Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware
INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one…
Meet CrowdStrike’s Adversary of the Month for October: DUNGEON SPIDER
DUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has been active since February 2016 and…
Cutwail Spam Campaign Uses Steganography to Distribute URLZone
CrowdStrike® Falcon® Intelligence™ has observed a new Cutwail spam campaign from NARWHAL SPIDER on 24 October 2018. NARWHAL SPIDER is the adversary…
Meet CrowdStrike’s Adversary of the Month for September: COBALT SPIDER
COBALT SPIDER is a financially-motivated criminal group responsible for attacks on financial institutions (FIs) in Russia, Central Asia and Eastern Europe. The…