{
	"id": "5d355470-d81e-4df9-8de7-f1856a7268b9",
	"created_at": "2026-04-06T00:18:39.32109Z",
	"updated_at": "2026-04-10T03:35:13.821647Z",
	"deleted_at": null,
	"sha1_hash": "47114d8d9118353a9d01e10c9dde894b10b51ca0",
	"title": "Curly Spider Adversary Profile | CrowdStrike",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1032230,
	"plain_text": "Curly Spider Adversary Profile | CrowdStrike\r\nArchived: 2026-04-05 17:33:52 UTC\r\nDiscover the adversaries targeting your industry\r\n Back to Adversary Universe\r\nCURLY SPIDER is an eCrime group who has conducted intrusions targeting predominantly North America- and\r\nWestern Europe-based entities across various sectors. Analysis of leaked chat logs shows that CURLY SPIDER\r\nlikely originated from MALLARD SPIDER, and likely operated as an initial access broker (IAB) and ransomware\r\naffiliate for WANDERING SPIDER before migrating to TUNNEL SPIDER's Cactus ransomw...\r\nhttps://www.crowdstrike.com/adversaries/curly-spider/\r\nPage 1 of 3\n\nCurly Spider\r\nRussian Federation, Eastern Europe, Europe\r\nCommunity Identifiers\r\nStorm-1811\r\nWho's targeting your industry?\r\nToday's adversaries are faster, smarter, and better resourced. Know who they are and how to stop them.\r\nView adversaries\r\nhttps://www.crowdstrike.com/adversaries/curly-spider/\r\nPage 2 of 3\n\nCrowdStrike 2025 Threat Hunting Report\r\nAdversaries weaponize and target AI at scale.\r\nSource: https://www.crowdstrike.com/adversaries/curly-spider/\r\nhttps://www.crowdstrike.com/adversaries/curly-spider/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://www.crowdstrike.com/adversaries/curly-spider/"
	],
	"report_names": [
		"curly-spider"
	],
	"threat_actors": [
		{
			"id": "aa5b200f-a6c6-4d17-bc65-911d9a7bf4ef",
			"created_at": "2022-10-25T16:07:23.866039Z",
			"updated_at": "2026-04-10T02:00:04.765416Z",
			"deleted_at": null,
			"main_name": "Mallard Spider",
			"aliases": [
				"Gold Lagoon"
			],
			"source_name": "ETDA:Mallard Spider",
			"tools": [
				"Egregor",
				"Mimikatz",
				"Oakboat",
				"PinkSlip",
				"Pinkslipbot",
				"ProLock",
				"PwndLocker",
				"QakBot",
				"Qbot",
				"QuackBot",
				"QuakBot"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d5cb8d20-b5b9-4ec6-9660-3dded9bd3c89",
			"created_at": "2023-01-06T13:46:39.204681Z",
			"updated_at": "2026-04-10T02:00:03.245695Z",
			"deleted_at": null,
			"main_name": "MALLARD SPIDER",
			"aliases": [
				"GOLD LAGOON"
			],
			"source_name": "MISPGALAXY:MALLARD SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "908cf62e-45cd-492b-bf12-d0902e12fece",
			"created_at": "2024-08-20T02:00:04.543947Z",
			"updated_at": "2026-04-10T02:00:03.68848Z",
			"deleted_at": null,
			"main_name": "UNC4393",
			"aliases": [
				"Storm-1811",
				"CURLY SPIDER",
				"STAC5777"
			],
			"source_name": "MISPGALAXY:UNC4393",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2c936440-1695-4b9d-88c1-32ab6df31d1b",
			"created_at": "2025-03-04T02:00:03.004127Z",
			"updated_at": "2026-04-10T02:00:03.816503Z",
			"deleted_at": null,
			"main_name": "GOLD REBELLION",
			"aliases": [
				"WANDERING SPIDER",
				"White Dev 115",
				"Dark Scorpius"
			],
			"source_name": "MISPGALAXY:GOLD REBELLION",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c3c864b3-fac9-4d56-8500-7c06c829fbf8",
			"created_at": "2023-01-06T13:46:39.071873Z",
			"updated_at": "2026-04-10T02:00:03.203749Z",
			"deleted_at": null,
			"main_name": "TA2101",
			"aliases": [
				"GOLD VILLAGE",
				"Storm-0216",
				"DEV-0216",
				"UNC2198",
				"TUNNEL SPIDER",
				"Maze Team",
				"TWISTED SPIDER"
			],
			"source_name": "MISPGALAXY:TA2101",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6bc98fce-5e1c-46d8-9d1a-64b5cb5febc3",
			"created_at": "2025-04-23T02:00:55.20526Z",
			"updated_at": "2026-04-10T02:00:05.307504Z",
			"deleted_at": null,
			"main_name": "Storm-1811",
			"aliases": [
				"Storm-1811"
			],
			"source_name": "MITRE:Storm-1811",
			"tools": [
				"Black Basta",
				"Cobalt Strike",
				"Quick Assist",
				"BITSAdmin",
				"PsExec",
				"Impacket",
				"QakBot"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775434719,
	"ts_updated_at": 1775792113,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/47114d8d9118353a9d01e10c9dde894b10b51ca0.pdf",
		"text": "https://archive.orkl.eu/47114d8d9118353a9d01e10c9dde894b10b51ca0.txt",
		"img": "https://archive.orkl.eu/47114d8d9118353a9d01e10c9dde894b10b51ca0.jpg"
	}
}