{
	"id": "5801180e-77c1-4d80-a45f-f9ae1c855934",
	"created_at": "2026-04-06T00:06:59.477432Z",
	"updated_at": "2026-04-10T13:11:35.863314Z",
	"deleted_at": null,
	"sha1_hash": "352cad748f3fdc218b3b5d2e13f34ef62e5e1f12",
	"title": "MUMMY SPIDER | Threat Actor Profile | CrowdStrike",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55475,
	"plain_text": "MUMMY SPIDER | Threat Actor Profile | CrowdStrike\r\nBy AdamM\r\nArchived: 2026-04-05 13:48:54 UTC\r\nIn continuance of our monthly blog post to introduce a new threat actor, February 2018 features a criminally\r\nmotivated actor we call MUMMY SPIDER. This actor is associated with the malware commonly known as\r\nEmotet or Geodo. MUMMY SPIDER is a criminal entity linked to the core development of the malware most\r\ncommonly known as Emotet or Geodo. First observed in mid-2014, this malware shared code with the Bugat (aka\r\nFeodo) banking Trojan. However, MUMMY SPIDER swiftly developed the malware’s capabilities to include\r\nan RSA key exchange for command and control (C2) communication and a modular architecture. MUMMY\r\nSPIDER does not follow typical criminal behavioral patterns. In particular, MUMMY SPIDER usually conducts\r\nattacks for a few months before ceasing operations for a period of between three and 12 months, before\r\nreturning with a new variant or version. After a 10 month hiatus, MUMMY SPIDER returned Emotet to operation\r\nin December 2016 but the latest variant is not deploying a banking Trojan module with web injects, it is currently\r\nacting as a ‘loader’ delivering other malware packages. The primary modules perform reconnaissance on victim\r\nmachines, drop freeware tools for credential collection from web browsers and mail clients and a spam plugin for\r\nself-propagation. The malware is also issuing commands to download and execute other malware families such as\r\nthe banking Trojans Dridex and Qakbot. MUMMY SPIDER advertised Emotet on underground forums until 2015,\r\nat which time it became private. Therefore, it is highly likely that Emotet is operated solely for use by MUMMY\r\nSPIDER or with a small trusted group of customers.\r\nOther Known Criminal Adversaries\r\nCobalt Spider\r\nDungeon Spider\r\nSalty Spider (Sality)\r\nWicked Spider\r\nCurious about other nation-state adversaries? Visit our threat actor center to learn about the new adversaries\r\nthat the CrowdStrike team discovers.\r\nLearn More\r\nTo learn more about how to incorporate intelligence on threat actors like MUMMY SPIDER please visit\r\nthe Falcon Intelligence product page.\r\nWant the insights on the latest adversary tactics, techniques, and procedures (TTPs)? Download the\r\nCrowdStrike 2020 Global Threat Report\r\nSource: https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/\r\nhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"ETDA",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/"
	],
	"report_names": [
		"meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider"
	],
	"threat_actors": [
		{
			"id": "e8e18067-f64b-4e54-9493-6d450b7d40df",
			"created_at": "2022-10-25T16:07:24.515213Z",
			"updated_at": "2026-04-10T02:00:05.018868Z",
			"deleted_at": null,
			"main_name": "Mummy Spider",
			"aliases": [
				"ATK 104",
				"Gold Crestwood",
				"Mummy Spider",
				"TA542"
			],
			"source_name": "ETDA:Mummy Spider",
			"tools": [
				"Emotet",
				"Geodo",
				"Heodo"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6d1762e8-c48c-4fda-b4d1-ecb91179720e",
			"created_at": "2022-10-25T16:07:24.55351Z",
			"updated_at": "2026-04-10T02:00:05.031489Z",
			"deleted_at": null,
			"main_name": "Salty Spider",
			"aliases": [],
			"source_name": "ETDA:Salty Spider",
			"tools": [
				"Kookoo",
				"Kukacka",
				"Kuku",
				"SalLoad",
				"SaliCode",
				"Sality"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "220e1e99-97ab-440a-8027-b672c5c5df44",
			"created_at": "2022-10-25T16:47:55.773407Z",
			"updated_at": "2026-04-10T02:00:03.649501Z",
			"deleted_at": null,
			"main_name": "GOLD KINGSWOOD",
			"aliases": [
				"Cobalt Gang ",
				"Cobalt Spider "
			],
			"source_name": "Secureworks:GOLD KINGSWOOD",
			"tools": [
				"ATMSpitter",
				"Buhtrap",
				"Carbanak",
				"Cobalt Strike",
				"CobtInt",
				"Cyst",
				"Metasploit",
				"Meterpreter",
				"Mimikatz",
				"SpicyOmelette"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "9fe7fd84-e2b4-4db5-9c90-c4a5791d3f94",
			"created_at": "2023-01-06T13:46:38.904178Z",
			"updated_at": "2026-04-10T02:00:03.14055Z",
			"deleted_at": null,
			"main_name": "SALTY SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:SALTY SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "506404b2-82fb-4b7e-b40d-57c2e9b59f40",
			"created_at": "2023-01-06T13:46:38.870883Z",
			"updated_at": "2026-04-10T02:00:03.128317Z",
			"deleted_at": null,
			"main_name": "MUMMY SPIDER",
			"aliases": [
				"TA542",
				"GOLD CRESTWOOD"
			],
			"source_name": "MISPGALAXY:MUMMY SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "4d5f939b-aea9-4a0e-8bff-003079a261ea",
			"created_at": "2023-01-06T13:46:39.04841Z",
			"updated_at": "2026-04-10T02:00:03.196806Z",
			"deleted_at": null,
			"main_name": "APT41",
			"aliases": [
				"WICKED PANDA",
				"BRONZE EXPORT",
				"Brass Typhoon",
				"TG-2633",
				"Leopard Typhoon",
				"G0096",
				"Grayfly",
				"BARIUM",
				"BRONZE ATLAS",
				"Red Kelpie",
				"G0044",
				"Earth Baku",
				"TA415",
				"WICKED SPIDER",
				"HOODOO",
				"Winnti",
				"Double Dragon"
			],
			"source_name": "MISPGALAXY:APT41",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "273a41a8-5115-4f55-865f-0960a765f18c",
			"created_at": "2022-10-25T16:07:24.397947Z",
			"updated_at": "2026-04-10T02:00:04.974605Z",
			"deleted_at": null,
			"main_name": "Wicked Spider",
			"aliases": [
				"APT 22",
				"Bronze Export",
				"Bronze Olive",
				"Wicked Spider"
			],
			"source_name": "ETDA:Wicked Spider",
			"tools": [
				"Agent.dhwf",
				"AngryRebel",
				"Destroy RAT",
				"DestroyRAT",
				"DoublePulsar",
				"EternalBlue",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"Kaba",
				"Korplug",
				"Moudour",
				"Mydoor",
				"PCRat",
				"PlugX",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Xamtrav"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2dfaa730-7079-494c-b2f0-3ff8f3598a51",
			"created_at": "2022-10-25T16:07:23.474746Z",
			"updated_at": "2026-04-10T02:00:04.623746Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"ATK 67",
				"Cobalt Gang",
				"Cobalt Spider",
				"G0080",
				"Gold Kingswood",
				"Mule Libra",
				"TAG-CR3"
			],
			"source_name": "ETDA:Cobalt Group",
			"tools": [
				"ATMRipper",
				"ATMSpitter",
				"Agentemis",
				"AmmyyRAT",
				"AtNow",
				"COOLPANTS",
				"CobInt",
				"Cobalt Strike",
				"CobaltStrike",
				"Cyst Downloader",
				"Fareit",
				"FlawedAmmyy",
				"Formbook",
				"Little Pig",
				"Metasploit Stager",
				"Mimikatz",
				"More_eggs",
				"NSIS",
				"Nullsoft Scriptable Install System",
				"Pony Loader",
				"Ripper ATM",
				"SDelete",
				"Siplog",
				"SoftPerfect Network Scanner",
				"SpicyOmelette",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Terra Loader",
				"ThreatKit",
				"VenomKit",
				"cobeacon",
				"win.xloader"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "aa8d7ec6-128a-41b9-8cdc-01ad8843020f",
			"created_at": "2022-10-25T16:07:24.485077Z",
			"updated_at": "2026-04-10T02:00:05.005858Z",
			"deleted_at": null,
			"main_name": "Dungeon Spider",
			"aliases": [],
			"source_name": "ETDA:Dungeon Spider",
			"tools": [
				"Locky"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "00e7a6ed-1880-4391-b0b9-1f46fae0e5cc",
			"created_at": "2025-08-07T02:03:24.591024Z",
			"updated_at": "2026-04-10T02:00:03.717645Z",
			"deleted_at": null,
			"main_name": "BRONZE EXPORT",
			"aliases": [
				"TG-3279 ",
				"Wicked Spider "
			],
			"source_name": "Secureworks:BRONZE EXPORT",
			"tools": [
				"Conpee",
				"PlugX",
				"PwDump"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6898c5bc-48af-4e38-917b-f9f0a41d0ee2",
			"created_at": "2023-01-06T13:46:39.00984Z",
			"updated_at": "2026-04-10T02:00:03.179681Z",
			"deleted_at": null,
			"main_name": "DUNGEON SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:DUNGEON SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c11abba0-f5e8-4017-a4ee-acb1a7c8c242",
			"created_at": "2022-10-25T15:50:23.744036Z",
			"updated_at": "2026-04-10T02:00:05.294413Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"Cobalt Group",
				"GOLD KINGSWOOD",
				"Cobalt Gang",
				"Cobalt Spider"
			],
			"source_name": "MITRE:Cobalt Group",
			"tools": [
				"Mimikatz",
				"More_eggs",
				"SpicyOmelette",
				"SDelete",
				"Cobalt Strike",
				"PsExec"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "2ac83159-1d9d-4db4-a176-97be6b7b07c9",
			"created_at": "2024-06-19T02:03:08.024653Z",
			"updated_at": "2026-04-10T02:00:03.672512Z",
			"deleted_at": null,
			"main_name": "GOLD CRESTWOOD",
			"aliases": [
				"Mummy Spider ",
				"TA542 "
			],
			"source_name": "Secureworks:GOLD CRESTWOOD",
			"tools": [
				"Emotet"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434019,
	"ts_updated_at": 1775826695,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/352cad748f3fdc218b3b5d2e13f34ef62e5e1f12.pdf",
		"text": "https://archive.orkl.eu/352cad748f3fdc218b3b5d2e13f34ef62e5e1f12.txt",
		"img": "https://archive.orkl.eu/352cad748f3fdc218b3b5d2e13f34ef62e5e1f12.jpg"
	}
}