File Spider
Aliases: Spider
- First seen
- 2017-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:41:19
Targeted regions: country_code:ba country_code:rs country_code:hr
Context
A new ransomware called File Spider is being distributed through spam that targets victims in Bosnia and Herzegovina, Serbia, and Croatia. These spam emails contains malicious Word documents that will download and install the File Spider ransomware onto a victims computer.File Spider is currently being distributed through malspam that appears to be targeting countries such as Croatia, Bosnia and Herzegovina, and Serbia. The spam start with subjects like"Potrazivanje dugovanja", which translates to "Debt Collection" and whose message, according to Google Translate, appear to be in Serbian.
Detection coverage
- 1 YARA rules
Used by threat actors
- C0027 (campaign)
- Scattered Spider TTP Evolution - SaaS Targeting (campaign)
Detection rules
- MALPEDIA_Win_Spider_Rat_Auto (yara-rule)
Reports & references
- bleepingcomputer.com — File Spider Ransomware Targeting The Balkans With Malspam (report)
- id-ransomware.blogspot.com — File Spider Ransomware (report)