TINY SPIDER
According to CrowdStrike, this actor is using TinyLoader and TinyPOS, potentially buying access through Dridex infections.
source: misp-galaxy1 refs →
TINY SPIDER
TINY SPIDER uses Dridex to access networks and steals POS data with TinyLoader and TinyPOS.
Analyst brief
TINY SPIDER is a threat actor that potentially purchases network access via Dridex infections and deploys TinyLoader and TinyPOS tools to steal financial data. They primarily target organizations in the retail and hospitality sectors, focusing on point-of-sale (POS) systems. Key TTPs include deploying the TinyPOS malware through the TinyLoader loader and scraping credit card data from RAM. Defenders should enhance email security against Dridex infections, isolate POS networks, and monitor for suspicious memory-scraping activities.
unknown
FAQ2
Which sectors does the TINY SPIDER actor primarily target?
TINY SPIDER primarily targets organizations in the retail and hospitality sectors, focusing on point-of-sale (POS) systems.
What are the primary tools used by TINY SPIDER and their purpose?
TINY SPIDER uses the TinyPOS malware, deployed through the TinyLoader loader, to steal financial data. TinyPOS scrapes credit card data from RAM.
See also5
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.