LUNAR SPIDERThreat actor
- gold swathmore
According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections. On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in conjunction with TrickBot (developed and operated by WIZARD SPIDER), which may provide WIZARD SPIDER with additional tools to steal sensitive…From MISP Galaxy
Last reported 12 months ago, by The DFIR Report1 report
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.002SMB/Windows Admin Shares
“SMB/Windows Admin Shares - T1021.002”
- T1027.013Encrypted/Encoded File
“Encrypted/Encoded File - T1027.013”
- T1027.016Junk Code Insertion
“Junk Code Insertion - T1027.016”
What the reports say
1 report, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“The aforementioned file has been associated with high confidence to the Russian threat actor LUNAR SPIDER by Eclecticiq.”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
- techbulldigital[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.