Loading threat actor…
Spammy Bear is a Russian-linked cybercriminal threat actor associated with large-scale domain hijacking activity beginning in late 2018, including abuse of GoDaddy-managed infrastructure and use of the broader DNS hijacking technique later described as Sitting Ducks. The actor has been linked to the takeover of thousands of domains, including dormant or defensively registered domains belonging to legitimate organizations, and then repurposing those domains for malicious operations while impersonating trusted brands. Spammy Bear has been associated with exploitation of weaknesses in DNS setup and domain-claim workflows that allowed attackers to assume control of domains without compromising the legitimate owner’s registrar account. Reported operations included sending spam and extortion-themed bomb threat emails from hijacked domains and later leveraging similar hijacked domains to distribute GandCrab ransomware. The actor’s tradecraft aligns with infrastructure abuse, spoofing of legitimate brands, and use of stolen domain reputation to improve delivery and credibility of malicious email and malware campaigns. Spammy Bear is regarded as the earliest known threat actor publicly linked to the Sitting Ducks style of domain hijacking. The actor’s activity illustrates a financially motivated cybercriminal model centered on domain theft, spam operations, malware delivery, and related abuse of trusted internet infrastructure rather than traditional network intrusion against end victims.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-nexus cybercriminal actor observed exploiting the 'Sitting Ducks' DNS attack vector to hijack registered domains (without compromising registrar/DNS accounts) for malicious activity.
Responsible for GoDaddy domain hijacks and theft of approximately 4,000 domains, exploiting a vulnerability in GoDaddy’s DNS setup platform to register free accounts and send malicious email from dormant domains. The same domain abuse ecosystem was later linked to a GandCrab ransomware campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.