Lunar Spider - Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 19:52:57 UTC
 Other threat group: Lunar Spider
Names
Lunar Spider (CrowdStrike)
Gold SwathMore (SecureWorks)
Country Russia
Motivation Financial crime
First seen 2019
Description
Lunar Spider is reportedly associated with Wizard Spider, Gold Blackburn.
(CrowdStrike) On March 17, 2019, CrowdStrike Intelligence observed the use of a new
BokBot (developed and operated by Lunar Spider) proxy module in conjunction with TrickBot
(developed and operated by Wizard Spider), which may provide Wizard Spider with additional
tools to steal sensitive information and conduct fraudulent wire transfers. This activity also
provides further evidence to support the existence of a flourishing relationship between these
two actors.
BokBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542)
and Smoke Loader (operated by Smoky Spider).
BokBot itself has been observed to distribute TrickBot (Wizard Spider, Gold Blackburn) and
TinyLoader (Tiny Spider).
Observed
Sectors: Financial.
Countries: Worldwide.
Tools used BokBot, Vawtrak.
Information
Last change to this card: 07 January 2021
Download this actor card in PDF or JSON format
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=66489195-9057-41a3-bf53-82aa6106833a
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=66489195-9057-41a3-bf53-82aa6106833a
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=66489195-9057-41a3-bf53-82aa6106833a
Page 2 of 2