BOSS SPIDER
0 incidentes
0 paises
0 sectores
apt IR Ultimo: -
Aliases: GOLD LOWELL, Boss Spider, SamSam, Criminal
BOSS SPIDER, also known as GOLD LOWELL, is a financially motivated cybercriminal group that emerged around 2015, primarily conducting ransomware campaigns using custom variants of the SamSam ransomware. The group is assessed to be of Iranian origin, with alleged members being indicted by the U.S. DoJ in November 2018, which led to an abrupt halt in their observed activities. What distinguishes BOSS SPIDER is their interactive, hands-on approach to network compromise, often involving manual post-exploitation steps to deploy ransomware. They are known for targeting organizations through opportunistic scan-and-exploit tactics rather than broad phishing campaigns, specifically focusing on vulnerable internet-facing systems. They engaged in unique extortion practices, including offering free decryption of a single file to build trust, yet they would sometimes significantly increase ransom demands after initial payment. Their operations frequently included anti-forensic measures to hinder re