Mummy Spider

Executive Summary

Mummy Spider (TA542, GOLD CRESTWOOD), a nation-state threat actor with potential criminal affiliations, primarily engages in espionage activities targeting energy and government entities. Known for employing Emotet malware, this group seeks to compromise sensitive information through sophisticated campaigns. Their operations have been observed since 2017, focusing on sectors critical to national stability.

Goals & Targeting

Mummy Spider targets energy sector entities and government institutions to gather political and economic intelligence. This targeting suggests a focus on espionage for strategic advantage.

Mummy Spider is a nation-state actor with criminal links, operating primarily in the energy sector and targeting government institutions, particularly in Eastern Europe. Utilizing Emotet malware, this group has conducted long-term campaigns aimed at stealing sensitive data. Their activity spans from initial infections through phishing emails to credential dumping and lateral movement within targeted networks, showcasing their ability to maintain persistence.

Key Capabilities

• Emotet malware
• Spear-phishing via email attachments

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Mummy Spider uses campaigns requiring extended dwell time, leveraging Emotet for initial compromise and lateral movement. Their victims include energy companies and government bodies in Eastern Europe.

IOC Patterns

• Phishing emails with Emotet attachments
• Document macros activating Emotet

Recommended Actions

• Implement email filters to detect phishing attempts
• Monitor network processes

Suggested Tags