Velvet Tempest
alpha_spider is a financially motivated threat actor tracked by Microsoft as DEV-0504 and later renamed Velvet Tempest. The content describes it as a prolific ransomware affiliate that has deployed at least six ransomware-as-a-service payloads since 2020 and specifically identifies it as an affiliate of the ALPHV/BlackCat ransomware operation. Microsoft states that DEV-0504/Velvet Tempest relies on access brokers for initial access, has used compromised credentials and remote sign-in to internet-facing systems, and has deployed BlackCat against organizations including in the energy sector. Reported tradecraft includes hands-on-keyboard intrusions; use of Cobalt Strike Beacon; domain discovery; credential theft with tools such as Mimikatz and Rubeus; lateral movement and payload distribution with PsExec; disabling unprotected antivirus; data exfiltration including use of StealBit; and ransomware deployment. The content also links Velvet Tempest to ClickFix campaigns that led to a hands-on-keyboard intrusion culminating in deployment of the Termite ransomware. Aliases directly supported by the content are alpha_spider, DEV-0504, and Velvet Tempest.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Consumer Durables & Apparel
- Food, Beverage & Tobacco
- Software & Services
- Materials
- Capital Goods
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operator attributed with a ClickFix-driven intrusion culminating in hands-on-keyboard activity and deployment of Termite ransomware.
Operator attributed to a ClickFix-driven intrusion culminating in hands-on-keyboard activity and deployment of Termite ransomware.
Linked to a ClickFix-driven intrusion chain that culminates in hands-on-keyboard activity and deployment of Termite ransomware.
Financially motivated threat actor tracked by Microsoft under the Tempest family.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.