Wandering Spider
Wandering Spider, active since at least April 2020, is a notorious Big Game Hunting (BGH) adversary. Known for their use of a variety of ransomware families, this group has been linked to sophisticated attacks targeting organizations of all sizes. Their notable tools include Black Basta, DoppelPaymer, and REvil, among others.
Wandering Spider
Country of Origin
Members
Leadership
Wandering Spider TTPs
Wandering Spider employs advanced tactics, techniques, and procedures (TTPs) designed to maximize impact and revenue from their campaigns.
Tactics
Targeting businesses with high-value operations to demand large-scale ransoms (Big Game Hunting).
Gaining initial access through phishing campaigns aimed at exploiting user credentials.
Techniques
Delivering malware via email attachments or links persuading victims to execute malicious payloads.
Leveraging known vulnerabilities in networks to escalate access and deploy ransomware.
Procedures
Using tools like Black Basta to encrypt systems and display ransom notes.
Disabling security measures to prevent detection and remediation.
Want to Shut Down Threats Before They Start?
Indicators of Compromise (IoCs)
Suspicious file extension changes tied to ransomware encryption.
Anomalous network traffic to external servers via VPNs associated with known threat actor IPs.
Use of tools and techniques linked to ransomware families like DoppelPaymer and REvil.
Key Victims
While exact victim details are sparse, Wandering Spider typically targets industries such as financial services, healthcare, manufacturing, and logistics, where downtime incurs substantial costs.
Notable Cyberattacks
Operations involving the use of Black Basta ransomware since April 2022.
Historical deployment of ransomware like Egregor and Maze, notorious for their data exfiltration techniques.
Law Enforcement & Arrests
There are no confirmed arrests or law enforcement actions against Wandering Spider to date. Their operations suggest a highly adaptive and evasive adversarial network.
How to Defend Against Wandering Spider
Enhanced email security to filter and block phishing attempts.
Regular patch management to address vulnerabilities before they’re exploited.
Network segmentation to limit the lateral movement during an attack.
Using a 24/7 managed detection platform, like the Huntress Managed Security Platform, to identify and respond to threats before they escalate.
Huntress solutions provide tailored tools to monitor and mitigate threats, enhance endpoint security, and reduce the likelihood of ransomware infiltrating your environment.
