Loading threat actor…
Mallard Spider is the threat actor associated with development and operation of QakBot, a long-running eCrime malware platform widely used to enable follow-on intrusions. QakBot infections have been observed preceding hands-on-keyboard activity, Cobalt Strike deployment, lateral movement, data theft, and eventual ransomware deployment by downstream operators. Mallard Spider has also been assessed as likely acting as an access broker for big game hunting ransomware operators, providing initial footholds that other criminal actors monetize. The actor’s activity is best characterized as financially motivated cybercrime centered on initial compromise and post-compromise enablement. Reported intrusion chains involving QakBot include malware delivery followed by interactive post-exploitation, credential access, movement across victim environments, and exfiltration in support of later-stage extortion or ransomware operations conducted by partners or customers. Mallard Spider is distinct from Lunar Spider, which has been associated with IcedID, but both malware ecosystems have been cited as common precursors to major ransomware intrusions.
2 malware families Mallory has associated with this actor across public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.