RIDDLE SPIDER
According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware
source: misp-galaxy1 refs →
RIDDLE SPIDER
RIDDLE SPIDER is a criminal group operating Avaddon ransomware, known for double extortion attacks on Windows environments.
Analyst brief
RIDDLE SPIDER is the criminal group operating the Avaddon ransomware. They predominantly target Windows environments to encrypt corporate and personal networks. Their key TTPs include ransomware deployment, double extortion via data leak threats, and likely phishing for initial access. Defenders should prioritize robust offline backup strategies, email security hardening, and monitoring for anomalous network behaviors indicative of C2 communication.
unknown
FAQ2
Which ransomware family does RIDDLE SPIDER operate?
RIDDLE SPIDER is the criminal group operating the Avaddon ransomware.
What tactics are included in RIDDLE SPIDER's TTPs?
RIDDLE SPIDER's key TTPs include ransomware deployment, double extortion via data leak threats, and likely phishing for initial access.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.