Loading story…
CrowdStrike reported that CARBON SPIDER, a financially motivated threat actor long associated with large-scale payment card theft and cybercrime operations, shifted toward big-game hunting by targeting enterprises with hands-on intrusions that can enable ransomware deployment. The group was described as evolving beyond opportunistic fraud activity and adopting tactics more commonly seen in enterprise-focused extortion campaigns, including deeper network access, credential abuse, and post-compromise movement inside victim environments.
The reporting links CARBON SPIDER to a broader criminal maturation in which established eCrime actors repurpose their access, tooling, and operational discipline to pursue higher-value corporate targets. The activity highlights a threat model in which actors known for banking and carding operations increasingly pursue enterprise compromise for larger payouts, raising the risk that organizations facing an initial financially motivated intrusion may quickly confront full-scale ransomware or extortion operations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
CrowdStrike published a blog post analyzing how the CARBON SPIDER threat actor had embraced big game hunting tactics. The reference indicates this reporting was released on August 30, 2021.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Data-extortion intrusions increased sharply last year**, with Intel 471 tracking roughly **6,800 extortion-driven attacks**—about **63% higher than 2024**—and attributing much of the growth to heightened activity from **Qilin**, **Sp1d3r Hunters**, and **Clop** operations. More than half of impacted organizations were in the **United States**, with frequent targeting of **consumer and industrial product vendors, consulting firms, and manufacturing**; Intel 471 also assessed that **initial access brokers** increasingly focused on **remote access portals** as an entry point. The same analysis noted that attackers abused a significant portion of disclosed vulnerabilities (over **40% of 520** reported bugs) and forecast that **AI** will likely *accelerate* exploitation and enable higher-ROI fraud (e.g., deepfake impersonation), even if it is not yet the primary driver of intrusions. Broader threat reporting described a **fragmenting cybercrime economy** under law-enforcement pressure, with more **new ransomware variants** derived from leaked code and a more **modular “supply chain”** of specialized services (access, laundering, negotiation) that can rapidly reconstitute after disruptions. Separate reporting highlighted how **low-tech social engineering** remains effective—such as help-desk impersonation used to reset credentials and redirect payroll—and how healthcare continues to be a favored extortion target, including the emergence of a new **“Insomnia” data-theft** brand claiming mostly US healthcare-related victims. These trends reinforce that extortion risk is being driven not only by malware families, but by **repeatable access paths** (remote access exposure, credential reuse, and service-desk process weaknesses) that enable fast monetization.
Jun 29, 2026
Google Threat Intelligence Group and Mandiant reported that financially motivated intrusion activity is increasingly shifting away from **traditional ransomware encryption** toward **data-theft extortion**, even as ransomware remains a major enterprise threat. Google said data theft accompanied **77%** of ransomware intrusions it observed in 2025, up from **57%** in 2024, and noted that some ransomware-as-a-service operations now offer **data-theft-only** extortion options. The reporting also highlighted that English-speaking underground actors are increasingly focused on stealing data for leverage rather than deploying encryptors, with groups such as **Scattered Spider**, **ShinyHunters**, and **Clop** cited as examples of actors associated with large-scale extortion activity.
Jun 29, 2026
CrowdStrike reported that two financially motivated threat groups tied to **The Com** — **Cordial Spider** and **Snarky Spider** — are carrying out rapid data-theft and extortion campaigns against U.S.-based organizations across critical infrastructure and enterprise sectors, including aviation, retail, hospitality, financial services, legal, technology, automotive, and academia. The actors are closely aligned with the **Scattered Spider** playbook and have used voice phishing, text messages, email, and other social-engineering tactics since at least October 2025 to compromise identity platforms, steal credentials, session keys, and tokens, and pivot through victims’ SaaS environments. Ransom demands have reportedly reached seven figures, and some victims have also faced **DDoS** attacks or swatting. The intrusions rely on adversary-in-the-middle phishing pages that mimic legitimate single sign-on and identity-provider portals, enabling access to services such as **SharePoint**, **HubSpot**, and **Google Workspace** while largely bypassing traditional endpoint defenses. After gaining access, the attackers register their own MFA devices or emulators, disable or suppress alerts through inbox rules and email deletion, and move quickly to search for sensitive data and exfiltrate it, in some cases within an hour of initial access. Researchers said the groups differ in tradecraft — including operating hours, phishing infrastructure, leak sites, and MFA-registration methods — while both use commercial VPNs and residential proxy networks such as **Mullvad**, **Oxylabs**, **NetNut**, **9Proxy**, **Infatica**, and **NSOCKS** to blend into normal traffic and evade detection.
Jun 29, 2026