Prophet Spider
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adversary has likely functioned as an access broker — handing off access to a third party to deploy ransomware — in multiple instances.
Source-reported aliases: GOLD MELODY, UNC961. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/
https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker
https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated