Blind Spider
Blind Spider is a financially motivated threat actor tracked by CrowdStrike and identified as one of six major operators either based in Latin America or primarily focused on targets in the region, alongside Ocular Spider, Odyssey Spider, Plump Spider, Samba Spider, and Squab Spider. The content also states Blind Spider is also known as Blind Eagle. CrowdStrike included Blind Spider among threat actors that have leveraged AI in their operations. The available content does not provide high-confidence detail on Blind Spider’s specific tactics, techniques, or malware beyond noting that Sophos initially considered whether HeartCrypt activity might be attributable to Blind Spider because of some geographic overlap, but ultimately concluded the HeartCrypt campaigns reflected multiple different threat actors and found enough differences in payloads, injection mechanisms, and targeted locations to distinguish that activity from CrowdStrike’s Blind Spider cluster.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇨🇴 Colombia
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as leveraging AI in operations (no additional operational details provided in the content).
Financially motivated criminal activity cluster identified as a major operator in Latin America; described as based in LATAM or primarily focused on targets in the region.
Referenced as a possible but ultimately unconfirmed affiliate or user of the HeartCrypt packer-as-a-service operation, with geographic overlap in targeting, particularly Colombia.
Referenced as a distinct threat actor initially suspected of being behind HeartCrypt-related activity due to geographic target overlap, but the article concludes the broader HeartCrypt activity involved multiple threat actors rather than Blind Spider alone.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.