Lunar Spider

Description

Lunar Spider is reportedly associated with Wizard Spider, Gold Blackburn.

(CrowdStrike) On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by Lunar Spider) proxy module in conjunction with TrickBot (developed and operated by Wizard Spider), which may provide Wizard Spider with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors.

BokBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542) and Smoke Loader (operated by Smoky Spider).

BokBot itself has been observed to distribute TrickBot (Wizard Spider, Gold Blackburn) and TinyLoader (Tiny Spider).

Names

Name	Name-Giver
Lunar Spider	CrowdStrike
Gold SwathMore	SecureWorks

Country

• Russia

Motivation

• Financial crime

First Seen

2019

Observed Sectors

• Financial

Observed Countries

• Worldwide

Tools

• BokBot
• Vawtrak

Information

• https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/
• https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/

Other Information

Uuid

66489195-9057-41a3-bf53-82aa6106833a

Last Card Change

2021-01-07