Cybercrime
BOSS SPIDER
Also known as GOLD LOWELL
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Throughout 2018, CrowdStrike Intelligence tracked BOSS SPIDER as it regularly updated Samas ransomware and received payments to known Bitcoin (BTC) addresses. This consistent pace of activity came to an abrupt halt at the end of November 2018 when the U.S. DoJ released an indictment for Iran-based individuals Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, alleged members of the group.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
- https://www.secureworks.com/research/threat-profiles/gold-lowell
- https://www.secureworks.com/blog/samsam-converting-opportunity-into-profit
- https://www.secureworks.com/blog/samas-ransomware
- https://www.secureworks.com/blog/ransomware-deployed-by-adversary
- https://www.secureworks.com/research/samsam-ransomware-campaigns
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.