Prophet Spider

Also known as GOLD MELODY, UNC961

PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adversary has likely functioned as an access broker — handing off access to a third party to deploy ransomware — in multiple instances.

Recent activity

No posts or advisories have named this actor recently.

References

• https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/
• https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/
• https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker
• https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.