NARWHAL SPIDER

Also known as: GOLD ESSEX, Gold Essex, NARWHAL SPIDER, Narwhal Spider, Storm-0302, TA544

NARWHAL SPIDER’s operation of Cutwail v2 was limited to country-specific spam campaigns, although late in 2019 there appeared to be an effort to expand by bringing in INDRIK SPIDER as a customer.

🌍 Country ["[Unknown]"]

Associated Operations

2011-08 2013-10 2018-10 Cutwail botnet resurfaces in major Facebook scam-paign The Japanese-language spam campaign uses a mixture of malicious PowerShell (PS) and steganography — a method of sending data in a concealed format — to distribute the eCrime malware family URLZone (a.k.a. Bebloh). Without the Blackhole exploit kit around to inject malware such as the Zeus Trojan https://threatpost.com/cutwail-botnet-feeling-effects-of-blackhole-takedown/103228/ https://www.crowdstrike.com/blog/cutwail-spam-campaign-uses-steganography-to-distribute-urlzone/ https://www.infosecurity-magazine.com/news/cutwail-botnet-resurfaces-in-major-facebook-scam/ https://www.secureworks.com/blog/cutwail-spam-swapping-blackhole-for-magnitude-exploit-kit keepers of the Cutwail spam bot have been forced to resort to some old-school methods of sending malware such as direct email attachments.

Introduction

NARWHAL SPIDER’s operation of Cutwail v2 was limited to country-specific spam campaigns, although late in 2019 there appeared to be an effort to expand by bringing in INDRIK SPIDER as a customer.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2011-08
  • 2013-10
  • 2018-10
  • Cutwail botnet resurfaces in major Facebook scam-paign
  • The Japanese-language spam campaign uses a mixture of malicious PowerShell (PS) and steganography — a method of sending data in a concealed format — to distribute the eCrime malware family URLZone (a.k.a. Bebloh).
  • Without the Blackhole exploit kit around to inject malware such as the Zeus Trojan
  • https://threatpost.com/cutwail-botnet-feeling-effects-of-blackhole-takedown/103228/
  • https://www.crowdstrike.com/blog/cutwail-spam-campaign-uses-steganography-to-distribute-urlzone/
  • https://www.infosecurity-magazine.com/news/cutwail-botnet-resurfaces-in-major-facebook-scam/
  • https://www.secureworks.com/blog/cutwail-spam-swapping-blackhole-for-magnitude-exploit-kit
  • keepers of the Cutwail spam bot have been forced to resort to some old-school methods of sending malware such as direct email attachments.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • URLZone:
  • Ursnif:
  • Panda Banker:
  • Nymaim:
  • Chthonic:
  • Smoke Loader:
  • Cutwail:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.