TRAVELING SPIDER
- First seen
- 2019-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- individual
- Actor type
- criminal
- Profile updated
- 2026-07-07 11:59:49
Targeted industries: financial-services professional-services technology-and-telecommunications
Context
Crowdstrike Tracks the criminal developer of Nemty ransomware as TRAVELING SPIDER. The actor has been observed to take advantage of single-factor authentication to gain access to victim organizations through Citrix Gateway and send extortion-related emails using the victim’s own Microsoft Office 365 instance.
Reports & references
- cyberscoop.com — Coronavirus Hacking Disinformation Ransomware Spearphishing (report)
- CrowdStrike — Ransomware Preparedness A Call To Action (report)
- CrowdStrike — Report2020Crowdstrikeservicescyberfrontlines (report)