APT / THREAT GROUP

NARWHAL SPIDER

aliases

Last seen:Mar 17, 2026

Intelligence Profile

NARWHAL SPIDER’s operation of Cutwail v2 was limited to country-specific spam campaigns, although late in 2019 there appeared to be an effort to expand by bringing in INDRIK SPIDER as a customer.

Threat Analysis

NARWHAL SPIDER is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→http://www.secureworks.com/research/threat-profiles/gold-essex

→https://www.proofpoint.com/us/threat-insight/post/brushaloader-still-sweeping-victims-one-year-later

→https://www.proofpoint.com/us/threat-insight/post/holiday-lull-not-so-much

→https://www.proofpoint.com/us/threat-insight/post/urlzone-top-malware-japan-while-emotet-and-line-phishing-round-out-landscape-0

→https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta544-targets-geographies-italy-japan-range-malware

→https://www.proofpoint.com/us/blog/threat-insight/q4-2020-threat-report-quarterly-analysis-cybersecurity-trends-tactics-and-themes

Quick Facts

TypeAPT / Threat Group

Aliases4

SourceMalpedia

Also Known As

Storm-0302TA544NARWHAL SPIDERGOLD ESSEX

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search NARWHAL SPIDER