Lunar Spider is a threat actor attributed to RU, also known as Gold SwathMore, GOLD SWATHMORE. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Lunar Spider exploit?

Specific CVE exploitation data for Lunar Spider is being tracked. Check the Strobes VI threat actor profile for updates.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Lunar Spider

Also known as: Gold SwathMore, GOLD SWATHMORE

RUFinancial crime

Exploited CVEs

Overview

Lunar Spider is reportedly associated with Wizard Spider, Gold Blackburn . ( CrowdStrike ) On March 17, 2019, CrowdStrike Intelligence observed the use of a new BokBot (developed and operated by Lunar Spider) proxy module in conjunction with TrickBot (developed and operated by Wizard Spider), which may provide Wizard Spider with additional tools to steal sensitive information and conduct fraudulent wire transfers. This activity also provides further evidence to support the existence of a flourishing relationship between these two actors. BokBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542 ) and Smoke Loader (operated by Smoky Spider). BokBot itself has been observed to distribute TrickBot ( Wizard Spider, Gold Blackburn ) and TinyLoader ( Tiny Spider ).

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database