Loading threat actor…
Lunar Spider, also tracked as Gold Swathmore and commonly associated with TA542 in some reporting around IcedID operations, is a Russian-speaking financially motivated cybercrime group active since at least 2009. The group is widely linked to the development and operation of the IcedID malware family and, more recently, the Latrodectus loader/backdoor, which has increasingly been used as a successor or replacement in its intrusion ecosystem. Lunar Spider specializes in malware-enabled initial access and follow-on enablement for broader criminal operations. Its activity has included large-scale malware distribution through phishing, malvertising, SEO poisoning, fake software or security-update lures, fake tax-form themes, and ClickFix or fake-CAPTCHA style social engineering. Recent campaigns have used heavily obfuscated JavaScript downloaders and MSI-based infection chains to deliver Latrodectus, which in turn has been observed deploying Brute Ratel C4, IcedID, and BackConnect remote-access tooling. Intrusions linked to this ecosystem have progressed to hands-on-keyboard activity, credential theft, keylogging, persistence, and data exfiltration, with operators using remote-access capabilities such as reverse shell, reverse SOCKS, reverse VNC, and file-management functions. The group is strongly associated with the financially motivated eCrime ecosystem surrounding ransomware enablement. Reporting indicates Lunar Spider has acted as an initial-access broker and has longstanding ties to other major Russian-speaking cybercriminal groups, including Wizard Spider and actors associated with ALPHV/BlackCat, Nemty, and TA2101/Twisted Spider. IcedID access was made available to outside groups for ransomware campaigns, and Lunar Spider-linked tooling has been used to facilitate later-stage ransomware intrusions. Despite law-enforcement disruption of parts of its infrastructure during Operation Endgame in 2024, the group resumed activity and shifted emphasis from IcedID toward Latrodectus-based delivery chains. Operationally, Lunar Spider has demonstrated defense evasion through obfuscation, DLL execution via rundll32, sandbox checks, and use of legitimate services such as Telegram for victim monitoring and operational telemetry. Latrodectus has been observed establishing persistence through scheduled tasks, while related follow-on payloads and intrusions have used common post-exploitation frameworks including Brute Ratel C4 and Cobalt Strike. The group’s targeting is primarily opportunistic and financially driven, but recent reporting shows focused activity against the financial sector.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
27 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as an example of an APT campaign referenced in OTX pulses associated with Zerologon.
Associated ecosystem behind IcedID that multiple vendors assess as responsible for developing Latrodectus as a successor or replacement loader.
Named as a separate threat group whose representatives frequently communicated with Stern and members of GOLD ULRICK and GOLD BLACKBURN.
Lunar Spider is known for using Telegram as a channel for monitoring victim interactions with their FakeCaptcha panel, specifically in campaigns delivering the Latrodectus malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.