Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Prophet Spider · Unknown · misp-galaxy · refreshed 2026-10-06

Prophet Spider

  • GOLD MELODY
  • UNC961

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2016-0545, CVE-2020-1472, CVE-2020-14750, CVE-2020-14882, CVE-2021-22941

Analyst brief

misp-galaxy

PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adversary has likely functioned as an access broker — handing off access to a third party to deploy ransomware — in multiple instances.

CVEs Prophet Spider is cited as exploiting

none on KEV
  1. CVE-2021-229412026-10-17
    1. “At the start of 2022, CrowdStrike Intelligence and CrowdStrike Services investigated an incident in which PROPHET SPIDER exploited CVE-2021-22941”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  2. CVE-2020-14722026-10-17
    1. “CrowdStrike has also observed PROPHET SPIDER execute a ZeroLogon ( CVE-2020-1472 ) exploit binary from Linux targeting the victim’s Windows environment.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  3. CVE-2016-05452026-10-17
    1. “CrowdStrike has also observed PROPHET SPIDER exploit older Oracle CVEs, including CVE-2016-0545 , as well as perform SQL injection to gain access.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  4. CVE-2020-147502026-10-17
    1. “multiple campaigns by the eCrime actor PROPHET SPIDER where the adversary has exploited Oracle WebLogic using CVE-2020-14882 and CVE-2020-14750 directory traversal Remote Code Execution (RCE) vulnerabilities.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  5. CVE-2020-148822026-10-17
    1. “multiple campaigns by the eCrime actor PROPHET SPIDER where the adversary has exploited Oracle WebLogic using CVE-2020-14882 and CVE-2020-14750 directory traversal Remote Code Execution (RCE) vulnerabilities.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facili…
  2. 2.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile
  3. 3.secureworks.com/research/gold-melody-profile-of-an-initial-access-brok…
  4. 4.mandiant.com/resources/blog/unc961-multiverse-financially-motivated

Track Prophet Spider on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.