Introduction
Publicly known as ‘EmpireMonkey’, ANTHROPOID SPIDER conducted phishing campaigns in February and March 2019, spoofing French, Norwegian and Belizean financial regulators and institutions. These campaigns used macro-enabled Microsoft documents to deliver the PowerShell Empire post-exploitation framework. ANTHROPOID SPIDER likely enabled a breach that allegedly involved fraudulent transfers over the SWIFT network.
Activities and Tactics
Targeted Sectors: Finance
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
- 2021-03
- Bank of Valletta
- Nine Entertainment warns ransomware recovery ‘will take time’
- https://www.itnews.com.au/news/nine-entertainment-warns-ransomware-recovery-will-take-time-562755
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- PowerDuke
- POWERSTATS
- Power Loader
- POWERSOURCE
- Xploit
- PowerRAT
- MedusaLocker:
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
References pending cataloguing.