Who is Salty Spider (Sality)?
Common Aliases SALTY SIDER is most commonly identified with the botnet it maintains (Sality) and it’s associated pseudonyms: KuKu SalLoad Kookoo SaliCode…
Research & Threat Intel
Webcast: A Deep Dive Into the Mobile Malware Report Trends and Recommendations
A new webcast, “Threat Landscape: Mobile Malware,” delves into the challenges of securing mobile devices in light of their ubiquitous use in…
CrowdStrike Mobile Threat Report Offers Trends and Recommendations for Securing Your Organization
The universal adoption of mobile devices in business environments has created new attack vectors that organizations struggle to address. A new report…
BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0
CrowdStrike® Intelligence has identified a new ransomware variant identifying itself as BitPaymer. This new variant was behind a series of ransomware campaigns…
New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration
On March 17, 2019, CrowdStrike® Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in…
PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware
CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments, using lateral movement techniques and tooling commonly associated…
Meet The Threat Actors: List of APTs and Adversary Groups
1. How Threat Actors are Classified Our intelligence team is dedicated to tracking the activities of threat actor groups and advanced persistent…
“Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
CrowdStrike® Intelligence observed a new campaign from a LUNAR SPIDER affiliate to distribute WIZARD SPIDER's TrickBot malware on Feb. 7, 2019. However,…
Who is FANCY BEAR (APT28)?
The nation-state adversary group known as FANCY BEAR (also known as APT28 or Sofacy) has been operating since at least 2008 and represents…
Enhancing Secure Boot Chain on Fedora 29
This blog is from the CrowdStrike Intelligence Advanced Research Team Motivation What is worse than a failing system? A (silently) compromised, yet…