BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0
CrowdStrike® Intelligence has identified a new ransomware variant identifying itself as BitPaymer. This new variant was behind a series of ransomware campaigns…
Research & Threat Intel
New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration
On March 17, 2019, CrowdStrike® Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in…
PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware
CrowdStrike® Intelligence has recently observed PINCHY SPIDER affiliates deploying GandCrab ransomware in enterprise environments, using lateral movement techniques and tooling commonly associated…
Meet The Threat Actors: List of APTs and Adversary Groups
1. How Threat Actors are Classified Our intelligence team is dedicated to tracking the activities of threat actor groups and advanced persistent…
“Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
CrowdStrike® Intelligence observed a new campaign from a LUNAR SPIDER affiliate to distribute WIZARD SPIDER's TrickBot malware on Feb. 7, 2019. However,…
Who is FANCY BEAR (APT28)?
The nation-state adversary group known as FANCY BEAR (also known as APT28 or Sofacy) has been operating since at least 2008 and represents…
Enhancing Secure Boot Chain on Fedora 29
This blog is from the CrowdStrike Intelligence Advanced Research Team Motivation What is worse than a failing system? A (silently) compromised, yet…
Widespread DNS Hijacking Activity Targets Multiple Sectors
CrowdStrike® Intelligence™ has been researching reports of widespread DNS hijacking activity since information on the attacks became publicly available earlier this month.1 The…
Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware
WIZARD SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a…
Farewell to Kelihos and ZOMBIE SPIDER
The Kelihos peer-to-peer botnet was one of the largest and longest-operating cybercrime infrastructures in existence. Its origins can be traced back to…