RATPAK SPIDER is a threat actor known for leaking the Pegasus malware framework, primarily targeting Russia's financial sector.
RATPAK SPIDER is a threat actor known for the July 2018 leak of their Pegasus malware framework, primarily targeting Russia's financial sector. The associated Buhtrap malware has been observed in SWC campaigns also aimed at Russian users. Key TTPs involve the use of leaked source code and targeted malware operations against financial institutions. Defenders should focus on monitoring for indicators linked to the Pegasus and Buhtrap malware, particularly anomalous banking trojan activity targeting the financial sector.
In July 2018, the source code of Pegasus, RATPAK SPIDER’s malware framework, was anonymously leaked. This malware has been linked to the targeting of Russia’s financial sector. Associated malware, Buhtrap, which has been leaked previously, was observed this year in connection with SWC campaigns that also targeted Russian users.
RATPAK SPIDER is known for the anonymous leak of the source code for their Pegasus malware framework in July 2018.
RATPAK SPIDER primarily targets Russia's financial sector.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.