Spyder

Spyder is a custom modular backdoor associated primarily with the China-aligned FishMonger intrusion set, which is also tracked under the Winnti umbrella and overlaps with reporting on RedHotel/TAG-22. It has been described as a backdoor typically used by FishMonger and as part of RedHotel’s bespoke malware families alongside FunnySwitch, while also appearing in earlier Winnti-linked activity targeting Hong Kong universities. ESET reported Spyder use during Operation FishMedley in 2022 against organizations in Taiwan, Thailand, Hungary, Turkey, the United States, and France, including government entities, NGOs, a think tank, and Catholic organizations. In one observed intrusion at a Thai government victim, a Spyder loader was downloaded from a compromised internal web server as aa.doc and dropped as C:\Users\Public\task.exe. The Spyder payload used the hardcoded C2 server 61.238.103[.]165; multiple subdomains of junlper[.]com resolved to that IP in 2022, and junlper[.]com was identified as a known Spyder C2 domain designed as a homoglyph of juniper.net. A self-signed TLS certificate with thumbprint 89EDCFFC66EDA3AEB75E140816702F9AC73A75F0 was observed on port 443 of 61.238.103[.]165 from May to December 2022 and was previously associated with FishMonger. Additional reporting links Spyder to RedHotel, a prolific Chinese state-sponsored threat group active since at least 2019 that targeted government, academia, aerospace, media, telecommunications, and R&D sectors across at least 17 countries from 2021 to 2023. Separate content also notes similarity-based links between StreamSpy and Spyder, and describes Spyder as a variant of a backdoor named WarHawk attributed to SideWinder, but the strongest direct attribution in the provided material is to FishMonger/RedHotel.