Twisted Spider
TWISTED SPIDER is a financially motivated eCrime threat actor associated with big game hunting ransomware and data extortion. The content links the group to Maze and Egregor and states that TWISTED SPIDER adopted data-leak extortion tactics in November 2019; CrowdStrike singled out this adoption as a key 2020 trend that catalyzed broader ransomware actor use of data extortion. CrowdStrike reported TWISTED SPIDER was the most prolific healthcare-targeting big game hunting actor in 2020, achieving at least 26 healthcare infections that year, predominantly in the United States, using Maze and Egregor. The content also states TWISTED SPIDER is part of the "Maze Cartel" alongside VIKING SPIDER and LockBit operators, and another reference lists TWISTED SPIDER among members alongside VIKING SPIDER, the LockBit gang, and the SunCrypt gang. EclecticIQ assessed with high confidence that the Russian-speaking financially motivated actor LUNAR SPIDER maintains affiliations with TA2101 (aka TWISTED SPIDER), and that TWISTED SPIDER has leveraged LUNAR SPIDER's IcedID malware to gain initial access to victim environments. One mention context also maps Storm-0216 to financially motivated TWISTED SPIDER and UNC2198.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated threat actor tracked by Microsoft as a Storm cluster.
Listed as part of a broader 'Ransom Cartel/Maze Cartel' collection of criminals (per cited reporting) that use ransomware for extortion; no further specifics in this content.
Named activity cluster referenced as affiliated with Lunar Spider and leveraging IcedID for initial access.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.