Boss Spider, Gold Lowell
Description
(SecureWorks) In late 2015, Secureworks Counter Threat Unit (CTU) researchers began tracking financially motivated campaigns leveraging SamSam ransomware (also known as Samas and SamsamCrypt). CTU researchers associate this activity with the Gold Lowell threat group. Gold Lowell typically scans for and exploits known vulnerabilities in Internet-facing systems to gain an initial foothold in a victim’s network. The threat actors then deploy the SamSam ransomware and demand payment to decrypt the victim’s files. The consistent tools and behaviors associated with SamSam intrusions since 2015 suggest that Gold Lowell is either a defined group or a collection of closely affiliated threat actors. Applying security updates in a timely manner and regularly monitoring for anomalous behaviors on Internet-facing systems are effective defenses against these tactics. Organizations should also create and test response plans for ransomware incidents and use backup solutions that are resilient to corruption or encryption attempts.
Names
| Name | Name-Giver |
|---|---|
| Boss Spider | CrowdStrike |
| Gold Lowell | SecureWorks |
| CTG-0007 | SecureWorks |
Country
Motivation
- Financial gain
First Seen
2015
Observed Sectors
Tools
Counter Operations
- 2018-11: Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, Municipalities, and Public Institutions, Causing Over $30 Million in Losses https://www.justice.gov/opa/pr/two-iranian-men-indicted-deploying-ransomware-extort-hospitals-municipalities-and-public
Information
- https://www.secureworks.com/research/samsam-ransomware-campaigns
- https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/
Other Information
Uuid
cdf69db4-97ac-4cd2-a705-a4d5ab2d302e
Last Card Change
2021-04-26