OVERLORD SPIDER, aka The Dark Overlord. Similar to ransomware operators today, OVERLORD SPIDER likely purchased RDP access to compromised servers on underground forums in order to exfiltrate data from corporate networks. The actor was known to attempt to “sell back” the data to the respective victims, threatening to sell the data to interested parties should the victim refuse to pay. There was at least one identified instance of OVERLORD SPIDER successfully selling victim data on an underground market.
What was the primary method used by the OVERLORD SPIDER group to gain initial access to corporate networks?+
The group obtained initial access via RDP credentials likely purchased from underground forums.
What extortion tactic did OVERLORD SPIDER use when a victim refused to pay?+
When payment was refused, the group threatened to sell the stolen data to interested parties, and there was at least one identified instance of them successfully selling victim data on an underground market.