Wicked Spider

Profile narrative

The only explicit details supplied about the threat actor known as Wicked Spider are its alias and a location indicator. According to the header of the prompt, the alias is Wicked Spider and the location is given as China. No article or report within the provided material mentions the name Wicked Spider in any context. Consequently, no specific tactics, techniques, or procedures are attributed to this alias in the source text. The location claim is presented without further granularity such as city, province, or organizational affiliation. The alias appears solely in the introductory metadata and is not referenced in any of the article titles, URLs, or report IDs. Therefore, the extent of known information is limited to the label and the country‑level attribution. No additional descriptors such as motivation, sophistication level, or size are supplied.

The supplied articles cover a range of distinct threat actors and campaigns unrelated to Wicked Spider. They discuss the JokerSpy macOS backdoor and its associated tools such as Swiftbelt and the xcc binary. Several reports describe activities attributed to APT41, also known as Winnti, BARIUM, or Blackfly, including ransomware attacks on Taiwanese firms and theft of pandemic relief funds. Other pieces detail financially motivated groups like FIN7 (also tracked as Carbanak) and FIN8, highlighting point‑of‑sale intrusions and ATM‑targeted malware. Additional articles cover Carbanak‑linked intrusions, ShadowPad deployments against Hong Kong universities, and the PortReuse backdoor used against an Asian manufacturer. The temporal span of the material ranges from 2016 to 2024, encompassing incidents in Japan, the United States, Taiwan, Hong Kong, and various European locations. None of these narratives reference the alias Wicked Spider or connect any described malware to a China‑based actor by that name. The articles provide indicators such as file names, command‑and‑control domains, and victim sectors, but none are linked to the Wicked Spider label. Consequently, there is no observable infrastructure, victimology, or operational pattern that can be ascribed to Wicked Spider from the source material. The absence of any mention means that any attempt to describe its behavior would rely on information outside the provided context.

Because the prompt contains no further details about Wicked Spider beyond its alias and location, any description of its motives, sophistication, size, or operational history would constitute speculation. The instructions explicitly forbid fabricating information or generalizing from unrelated actors. Accordingly, the only factual statements that can be made are those already presented: the alias Wicked Spider and the location China. All other characteristics, including preferred tools, typical targets, or geopolitical alignment, remain undetermined based on the available information. This limitation applies equally to assessments of its activity timeline, preferred victim sectors, or any alleged ties to specific campaigns. Therefore, the profile must be confined to the verified elements supplied in the header. No extrapolation beyond those elements is permissible under the given constraints. This concludes the factual profile that can be derived solely from the supplied context.

Incidents

Attributed incidents are available to members.