CIRCUS SPIDER is a Russian-speaking cybercriminal group known for developing the NetWalker ransomware and running a closed-affiliate program.
Analyst brief
CIRCUS SPIDER is a Russian-speaking cybercriminal group responsible for developing and maintaining the NetWalker ransomware. They primarily target large organizations in Big Game Hunting (BGH)-style operations, also leveraging spam for distribution. The group operates a closed-affiliate program, rigorously vetting partners based on prior revenue, field experience, and targeted industries. Defenders should heighten vigilance against spam-based delivery, monitor for NetWalker ransomware artifacts especially in critical sectors, and prepare incident response for a mature actor-driven extortion campaign.
CIRCUS SPIDER
unknown
According to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIRCUS SPIDER. Initially discovered in September 2019and havinga compilation timestamp dating back to 28 August 2019, NetWalker has been found to be used in Big Game Hunting (BGH)-style operations while also being distributed via spam. CIRCUS SPIDER is advertising NetWalkeras being a closed-affiliate program,and verifies applicants before they are being accepted as an affiliate. The requirements rangefrom providing proof of previous revenue in similar affiliates programs, experience in the field and what type of industry the applicantis targeting.
What business model underlies the NetWalker ransomware operation by CIRCUS SPIDER?+
CIRCUS SPIDER advertises NetWalker ransomware as a closed-affiliate program, accepting partners only after rigorous vetting based on proof of previous revenue.
What delivery methods are used for NetWalker ransomware in attacks conducted by CIRCUS SPIDER?+
NetWalker ransomware is used in Big Game Hunting (BGH)-style operations targeting large organizations while also being distributed via spam campaigns.