Threat actor
Graceful Spider
Russia · financial
Tracked by CyberSIXT since 7 Oct 2025
- Articles · all time
- 2
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 0
Names and sources
- TA505
- Named by CyberSIXT coverage
- ATK103
- Named by Malpedia · ta505
- CHIMBORAZO
- Named by Malpedia · ta505
- DEV-0950
- Named by Malpedia · ta505
- Dudear
- Named by Malpedia · ta505
- FIN11
- Named by Malpedia · ta505
- G0092
- Named by Malpedia · ta505
- GOLD TAHOE
- Named by Malpedia · ta505
All 36 names
- GRACEFUL SPIDER
- Named by Malpedia · ta505
- Hive0065
- Named by Malpedia · ta505
- Lace Tempest
- Named by Malpedia · ta505
- MONTY SPIDER
- Named by Malpedia · ta505
- SectorJ04
- Named by Malpedia · ta505
- SectorJ04 Group
- Named by Malpedia · ta505
- Spandex Tempest
- Named by Malpedia · ta505
- TA505
- Named by Malpedia · ta505
- MONTY SPIDER
- Named by Microsoft · Spandex Tempest
- Spandex Tempest
- Named by Microsoft · Spandex Tempest
- TA505
- Named by Microsoft · Spandex Tempest
- ATK103
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- CHIMBORAZO
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- Dudear
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- G0092
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- GOLD TAHOE
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- GRACEFUL SPIDER
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- Hive0065
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- SectorJ04
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- SectorJ04 Group
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- Spandex Tempest
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- TA505
- Named by MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- CHIMBORAZO
- Named by MITRE ATT&CK · G0092
- Hive0065
- Named by MITRE ATT&CK · G0092
- Spandex Tempest
- Named by MITRE ATT&CK · G0092
- TA505
- Named by MITRE ATT&CK · G0092
- Graceful Spider
- Named by CyberSIXT coverage
- 03c80674-35f8-4fe0-be2b-226ed0fcd69f
- Named by CyberSIXT coverage
Attributed facts
- category
- financial (Microsoft · Spandex Tempest)
- motivation
- financial (Microsoft · Spandex Tempest)
- origin
- Russia (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- sector
- Education (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- sector
- Finance (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- sector
- Health (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- sector
- Hospitality (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- sector
- Retail (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Australia (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Canada (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Czech Republic (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Germany (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Hungary (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- India (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Japan (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Romania (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Serbia (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Singapore (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- South Korea (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Spain (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Thailand (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- Turkey (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- United Kingdom (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
- Target country
- United States (MISP Galaxy · 03c80674-35f8-4fe0-be2b-226ed0fcd69f)
Malware and tools
Mimikatz (MITRE ATT&CK · G0092) Net (MITRE ATT&CK · G0092) Cobalt Strike (MITRE ATT&CK · G0092) PowerSploit (MITRE ATT&CK · G0092) TrickBot (MITRE ATT&CK · G0092) Azorult (MITRE ATT&CK · G0092) FlawedAmmyy (MITRE ATT&CK · G0092) ServHelper (MITRE ATT&CK · G0092) FlawedGrace (MITRE ATT&CK · G0092) Dridex (MITRE ATT&CK · G0092) Get2 (MITRE ATT&CK · G0092) SDBbot (MITRE ATT&CK · G0092) BloodHound (MITRE ATT&CK · G0092) AdFind (MITRE ATT&CK · G0092) Clop (MITRE ATT&CK · G0092) Amadey (MITRE ATT&CK · G0092) AndroMut (Malpedia · ta505) Clop (Malpedia · ta505) Dridex (Malpedia · ta505) FlawedAmmyy (Malpedia · ta505) FlawedGrace (Malpedia · ta505) Get2 (Malpedia · ta505) Locky (Malpedia · ta505) MirrorBlast (Malpedia · ta505) RMS (Malpedia · ta505) SDBbot (Malpedia · ta505) ServHelper (Malpedia · ta505) Silence (Malpedia · ta505) Teleport (Malpedia · ta505) TinyMet (Malpedia · ta505) TrickBot (Malpedia · ta505)
ATT&CK techniques
Tactic not recorded
- T1027.002
- Software Packing (MITRE ATT&CK · G0092)
- T1027.010
- Command Obfuscation (MITRE ATT&CK · G0092)
- T1027.013
- Encrypted/Encoded File (MITRE ATT&CK · G0092)
- T1055.001
- Dynamic-link Library Injection (MITRE ATT&CK · G0092)
- T1059.001
- PowerShell (MITRE ATT&CK · G0092)
- T1059.003
- Windows Command Shell (MITRE ATT&CK · G0092)
- T1059.005
- Visual Basic (MITRE ATT&CK · G0092)
- T1059.007
- JavaScript (MITRE ATT&CK · G0092)
- T1069
- Permission Groups Discovery (MITRE ATT&CK · G0092)
- T1071.001
- Web Protocols (MITRE ATT&CK · G0092)
- T1078.002
- Domain Accounts (MITRE ATT&CK · G0092)
- T1087.003
- Email Account (MITRE ATT&CK · G0092)
© The MITRE Corporation. Reproduced with permission. All techniques on MITRE ATT&CK
- Cl0p exploits PTC Windchill flaw for unauthenticated RCEThe Hacker News
- Oracle EBS Zero-Day (CVE-2025-61882) Under Active RCE Exploitation by GRACEFUL SPIDERSecurityOnline · first in our coverage