LUNAR SPIDER
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections. On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in conjunction with TrickBot (developed and operated by WIZARD SPIDER), which may provide WIZARD SPIDER with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors. Lunar Spider is reportedly associated withGrim Spider and Wizard Spider.
Source-reported aliases: GOLD SWATHMORE. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/
https://www.secureworks.com/research/threat-profiles/gold-swathmore