{ "id": "61c19df0-2593-4502-896f-b580dd4d1d76", "created_at": "2026-04-06T00:15:14.768284Z", "updated_at": "2026-04-10T03:35:43.326703Z", "deleted_at": null, "sha1_hash": "cdd6460d115d5eb89ceaea658772edf17a94c26e", "title": "DUNGEON SPIDER | Threat Actor Profile | CrowdStrike", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 64500, "plain_text": "DUNGEON SPIDER | Threat Actor Profile | CrowdStrike\r\nBy AdamM\r\nArchived: 2026-04-05 15:30:15 UTC\r\nDUNGEON SPIDER is a criminal group operating the ransomware most commonly known as Locky, which has\r\nbeen active since February 2016 and was last observed in late 2017. Locky is a ransomware tool that encrypts files\r\nusing a combination of cryptographic algorithms: RSA with a key size of 2,048 bits, and AES with a key size of\r\n128 bits. Locky targets a large number of file extensions and is able to encrypt data on shared network drives. In\r\nan attempt to further impact victims and prevent file recovery, Locky deletes all of the Shadow Volume Copies on\r\nthe machine. Locky uses a set of hard-coded IP addresses for C2 (command and control) communications, and\r\nonce the victim has been infected, an initial HTTP POST is made using a file path of /checkupdate appended to\r\nthe C2s. Locky will then continue to communicate with the hard-coded IP addresses thereafter, or it will resort to\r\nits domain generation algorithm (DGA), if they become unreachable. Some variants of Locky also have the ability\r\nto operate offline, meaning they do not require internet connectivity or C2s to encrypt a victim’s files. Each victim\r\nis assigned a personal identification number that is generated upon infection, sent back to the C2s, and used to\r\nprovide the victim-specific decryption key should the ransom be paid. Once infected with Locky, so-called “help\r\nfiles” are dropped onto the victim machine, providing details of how to pay the ransom for file recovery. The\r\nLocky ransom payment portal URL has remained the same for some time: g46mbrrzpfszonuk\u003c.\u003eonion/{personal\r\nID number}. CrowdStrike® CrowdStrike Falcon® IntelligenceTM has not observed distribution or development\r\nof Locky since late 2017, with one of the last major developments being the modification of the ransomware to\r\nuse a file extension of .diablo6 . Since Locky first came to the criminal market in early 2016, the ransomware\r\nquickly made a name for itself when it allegedly infected Hollywood Presbyterian Medical Center, resulting in a\r\nreported ransom payment of 40 Bitcoin (BTC). A ransomware variant dubbed PyLocky was observed in\r\nSeptember 2018 being distributed by a phishing campaign using an invoicing theme. PyLocky was found to be\r\ntargeting entities in France and Germany. Of note is the fact that PyLocky claims to be a version of Locky, which\r\nas noted above, has not been active for some time. It is Locky’s notoriety that has likely led to the operators of\r\nPyLocky choosing to appropriate its name and likeness; mimicking the names of successful ransomware families\r\nis a technique often used by criminal actors to gain customers. There is no evidence, as of this writing, that\r\nPyLocky is at all related to either Locky ransomware or DUNGEON SPIDER, the developers of Locky. However,\r\nthe emergence of PyLocky and its attempt to masquerade as a previously prolific and potent version of Locky\r\nindicates that adversaries continue to actively develop ransomware, and that it remains a dominant and viable\r\nthreat vector. DUNGEON SPIDER primarily relies on broad spam campaigns with malicious attachments for\r\ndistribution. Locky is the community/industry name associated with this actor.\r\nOther Known Criminal Adversaries\r\nCobalt Spider\r\nMummy Spider\r\nSalty Spider (Sality)\r\nWicked Spider\r\nhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-october-dungeon-spider/\r\nPage 1 of 2\n\nCurious about other nation-state adversaries? Visit our threat actor center to learn about the new adversaries\r\nthat the CrowdStrike team discovers.\r\nLearn More:\r\nTo learn more about how to incorporate intelligence on threat actors such as DUNGEON SPIDER into\r\nyour security strategy, please visit the Falcon Intelligence product page\r\nDownload the CrowdStrike 2020 Global Threat Report to get the latest insights onmodern adversaries and\r\ntheir tactics, techniques, and procedures (TTPs)\r\nSource: https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-october-dungeon-spider/\r\nhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-october-dungeon-spider/\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "ETDA", "Malpedia" ], "references": [ "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-october-dungeon-spider/" ], "report_names": [ "meet-crowdstrikes-adversary-of-the-month-for-october-dungeon-spider" ], "threat_actors": [ { "id": "e8e18067-f64b-4e54-9493-6d450b7d40df", "created_at": "2022-10-25T16:07:24.515213Z", "updated_at": "2026-04-10T02:00:05.018868Z", "deleted_at": null, "main_name": "Mummy Spider", "aliases": [ "ATK 104", "Gold Crestwood", "Mummy Spider", "TA542" ], "source_name": "ETDA:Mummy Spider", "tools": [ "Emotet", "Geodo", "Heodo" ], "source_id": "ETDA", "reports": null }, { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "6d1762e8-c48c-4fda-b4d1-ecb91179720e", "created_at": "2022-10-25T16:07:24.55351Z", "updated_at": "2026-04-10T02:00:05.031489Z", "deleted_at": null, "main_name": "Salty Spider", "aliases": [], "source_name": "ETDA:Salty Spider", "tools": [ "Kookoo", "Kukacka", "Kuku", "SalLoad", "SaliCode", "Sality" ], "source_id": "ETDA", "reports": null }, { "id": "220e1e99-97ab-440a-8027-b672c5c5df44", "created_at": "2022-10-25T16:47:55.773407Z", "updated_at": "2026-04-10T02:00:03.649501Z", "deleted_at": null, "main_name": "GOLD KINGSWOOD", "aliases": [ "Cobalt Gang ", "Cobalt Spider " ], "source_name": "Secureworks:GOLD KINGSWOOD", "tools": [ "ATMSpitter", "Buhtrap", "Carbanak", "Cobalt Strike", "CobtInt", "Cyst", "Metasploit", "Meterpreter", "Mimikatz", "SpicyOmelette" ], "source_id": "Secureworks", "reports": null }, { "id": "9fe7fd84-e2b4-4db5-9c90-c4a5791d3f94", "created_at": "2023-01-06T13:46:38.904178Z", "updated_at": "2026-04-10T02:00:03.14055Z", "deleted_at": null, "main_name": "SALTY SPIDER", "aliases": [], "source_name": "MISPGALAXY:SALTY SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "506404b2-82fb-4b7e-b40d-57c2e9b59f40", "created_at": "2023-01-06T13:46:38.870883Z", "updated_at": "2026-04-10T02:00:03.128317Z", "deleted_at": null, "main_name": "MUMMY SPIDER", "aliases": [ "TA542", "GOLD CRESTWOOD" ], "source_name": "MISPGALAXY:MUMMY SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "4d5f939b-aea9-4a0e-8bff-003079a261ea", "created_at": "2023-01-06T13:46:39.04841Z", "updated_at": "2026-04-10T02:00:03.196806Z", "deleted_at": null, "main_name": "APT41", "aliases": [ "WICKED PANDA", "BRONZE EXPORT", "Brass Typhoon", "TG-2633", "Leopard Typhoon", "G0096", "Grayfly", "BARIUM", "BRONZE ATLAS", "Red Kelpie", "G0044", "Earth Baku", "TA415", "WICKED SPIDER", "HOODOO", "Winnti", "Double Dragon" ], "source_name": "MISPGALAXY:APT41", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "273a41a8-5115-4f55-865f-0960a765f18c", "created_at": "2022-10-25T16:07:24.397947Z", "updated_at": "2026-04-10T02:00:04.974605Z", "deleted_at": null, "main_name": "Wicked Spider", "aliases": [ "APT 22", "Bronze Export", "Bronze Olive", "Wicked Spider" ], "source_name": "ETDA:Wicked Spider", "tools": [ "Agent.dhwf", "AngryRebel", "Destroy RAT", "DestroyRAT", "DoublePulsar", "EternalBlue", "Farfli", "Gh0st RAT", "Ghost RAT", "Kaba", "Korplug", "Moudour", "Mydoor", "PCRat", "PlugX", "RedDelta", "Sogu", "TIGERPLUG", "TVT", "Thoper", "Xamtrav" ], "source_id": "ETDA", "reports": null }, { "id": "2dfaa730-7079-494c-b2f0-3ff8f3598a51", "created_at": "2022-10-25T16:07:23.474746Z", "updated_at": "2026-04-10T02:00:04.623746Z", "deleted_at": null, "main_name": "Cobalt Group", "aliases": [ "ATK 67", "Cobalt Gang", "Cobalt Spider", "G0080", "Gold Kingswood", "Mule Libra", "TAG-CR3" ], "source_name": "ETDA:Cobalt Group", "tools": [ "ATMRipper", "ATMSpitter", "Agentemis", "AmmyyRAT", "AtNow", "COOLPANTS", "CobInt", "Cobalt Strike", "CobaltStrike", "Cyst Downloader", "Fareit", "FlawedAmmyy", "Formbook", "Little Pig", "Metasploit Stager", "Mimikatz", "More_eggs", "NSIS", "Nullsoft Scriptable Install System", "Pony Loader", "Ripper ATM", "SDelete", "Siplog", "SoftPerfect Network Scanner", "SpicyOmelette", "Taurus Builder", "Taurus Builder Kit", "Taurus Loader", "Terra Loader", "ThreatKit", "VenomKit", "cobeacon", "win.xloader" ], "source_id": "ETDA", "reports": null }, { "id": "aa8d7ec6-128a-41b9-8cdc-01ad8843020f", "created_at": "2022-10-25T16:07:24.485077Z", "updated_at": "2026-04-10T02:00:05.005858Z", "deleted_at": null, "main_name": "Dungeon Spider", "aliases": [], "source_name": "ETDA:Dungeon Spider", "tools": [ "Locky" ], "source_id": "ETDA", "reports": null }, { "id": "00e7a6ed-1880-4391-b0b9-1f46fae0e5cc", "created_at": "2025-08-07T02:03:24.591024Z", "updated_at": "2026-04-10T02:00:03.717645Z", "deleted_at": null, "main_name": "BRONZE EXPORT", "aliases": [ "TG-3279 ", "Wicked Spider " ], "source_name": "Secureworks:BRONZE EXPORT", "tools": [ "Conpee", "PlugX", "PwDump" ], "source_id": "Secureworks", "reports": null }, { "id": "6898c5bc-48af-4e38-917b-f9f0a41d0ee2", "created_at": "2023-01-06T13:46:39.00984Z", "updated_at": "2026-04-10T02:00:03.179681Z", "deleted_at": null, "main_name": "DUNGEON SPIDER", "aliases": [], "source_name": "MISPGALAXY:DUNGEON SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "c11abba0-f5e8-4017-a4ee-acb1a7c8c242", "created_at": "2022-10-25T15:50:23.744036Z", "updated_at": "2026-04-10T02:00:05.294413Z", "deleted_at": null, "main_name": "Cobalt Group", "aliases": [ "Cobalt Group", "GOLD KINGSWOOD", "Cobalt Gang", "Cobalt Spider" ], "source_name": "MITRE:Cobalt Group", "tools": [ "Mimikatz", "More_eggs", "SpicyOmelette", "SDelete", "Cobalt Strike", "PsExec" ], "source_id": "MITRE", "reports": null }, { "id": "2ac83159-1d9d-4db4-a176-97be6b7b07c9", "created_at": "2024-06-19T02:03:08.024653Z", "updated_at": "2026-04-10T02:00:03.672512Z", "deleted_at": null, "main_name": "GOLD CRESTWOOD", "aliases": [ "Mummy Spider ", "TA542 " ], "source_name": "Secureworks:GOLD CRESTWOOD", "tools": [ "Emotet" ], "source_id": "Secureworks", "reports": null } ], "ts_created_at": 1775434514, "ts_updated_at": 1775792143, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/cdd6460d115d5eb89ceaea658772edf17a94c26e.pdf", "text": "https://archive.orkl.eu/cdd6460d115d5eb89ceaea658772edf17a94c26e.txt", "img": "https://archive.orkl.eu/cdd6460d115d5eb89ceaea658772edf17a94c26e.jpg" } }