ANTHROPOID SPIDER

Also known as: Empire Monkey, CobaltGoblin, ANTHROPOID SPIDER, EmpireMonkey

Publicly known as ‘EmpireMonkey’, ANTHROPOID SPIDER conducted phishing campaigns in February and March 2019, spoofing French, Norwegian and Belizean financial regulators and institutions. These campaigns used macro-enabled Microsoft documents to deliver the PowerShell Empire post-exploitation framework. ANTHROPOID SPIDER likely enabled a breach that allegedly involved fraudulent transfers over the SWIFT network.

Finance

Associated Operations

Bank of Valletta

Introduction

Publicly known as ‘EmpireMonkey’, ANTHROPOID SPIDER conducted phishing campaigns in February and March 2019, spoofing French, Norwegian and Belizean financial regulators and institutions. These campaigns used macro-enabled Microsoft documents to deliver the PowerShell Empire post-exploitation framework. ANTHROPOID SPIDER likely enabled a breach that allegedly involved fraudulent transfers over the SWIFT network.

Activities and Tactics

Targeted Sectors: Finance

Notable Campaigns

  • Bank of Valletta

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • PowerDuke
  • POWERSTATS
  • Power Loader
  • POWERSOURCE
  • Xploit
  • PowerRAT

Attribution and Evidence

Information pending cataloguing.

References

References pending cataloguing.