APT / THREAT GROUP

LUNAR SPIDER

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to CrowdStrike, this actor is using BokBok/IcedID, potentially buying distribution through Emotet infections.

On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by LUNAR SPIDER) proxy module in conjunction with TrickBot (developed and operated by WIZARD SPIDER), which may provide WIZARD SPIDER with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors.

Lunar Spider is reportedly associated withGrim Spider and Wizard Spider.

Threat Analysis

LUNAR SPIDER is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning LUNAR SPIDER

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

The DFIR Report· Sep 29, 2025

External References

→https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/

→https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/

→https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/

→https://www.secureworks.com/research/threat-profiles/gold-swathmore

Quick Facts

TypeAPT / Threat Group

Aliases2

SourceMalpedia

Also Known As

GOLD SWATHMORELUNAR SPIDER

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search LUNAR SPIDER