Loading threat actor…
SPRITE SPIDER is a financially motivated eCrime threat actor associated with the Defray777 ransomware family. The group is known for developing and deploying ransomware for Linux-based VMware ESXi environments, reflecting a focus on virtualization infrastructure and enterprise-impacting extortion operations. Reporting ties the actor to the deployment of an ELF ransomware variant for ESXi hosts in 2020, indicating capability to target hypervisors in addition to more traditional enterprise systems. Known aliases are limited in the available information, and the actor is principally identified as SPRITE SPIDER, the operators of Defray777.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.