RIDDLE SPIDER

Executive Summary

RIDDLE SPIDER is a threat actor associated with the Avaddon ransomware family, which employs double extortion tactics. The group primarily targets healthcare, education, and other sectors globally, leveraging sophisticated techniques to breach organizations and encrypt sensitive data for financial gain.

Goals & Targeting

RIDDLE SPIDER's strategic objectives are centered around financial gain through ransomware deployments. The group primarily targets sectors with high data sensitivity and recovery costs, such as healthcare and education, where the impact of disruptions can be severe. RIDDLE SPIDER's global reach suggests a focus on broad geographic targeting to maximize victim pools.

RIDDLE SPIDER operates as a high-sophistication cybercriminal group responsible for deploying the Avaddon ransomware. This actor is known for its ability to disrupt operations by encrypting critical systems and demanding substantial ransoms, often threatening to release stolen data unless paid. The group's activities demonstrate a clear focus on maximizing financial gain through targeted ransom campaigns. RIDDLE SPIDER's operations highlight the evolving nature of ransomware attacks, where threat actors increasingly adopt professionalized tactics and tools to breach defenses and extort victims.

Key Capabilities

• Ransomware deployment (Avaddon)
• Double extortion tactics
• Spear-phishing campaigns
• Exploitation of remote desktop services (T5001)
• Lateral movement within networks
• Data encryption for disruption and extortion

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

RIDDLE SPIDER's campaigns demonstrate a focus on sectors with high recovery costs and data sensitivity. The group has been observed targeting healthcare organizations globally, causing significant disruptions. Notable operations include large-scale ransomware deployments that have resulted in data leaks and financial losses for victims. Campaign patterns indicate a preference for double extortion tactics, where encrypted data is also exfiltrated and released unless ransoms are paid.

IOC Patterns

• Ransomware encryption patterns matching Avaddon
• Creation of new user accounts with high privileges
• External communication channels for ransom negotiations
• Lateral movement via RDP or WMI
• Encrypting backup files and systems

Recommended Actions

• Implement robust patch management to address remote desktop service vulnerabilities (T5001)
• Deploy endpoint detection and response (EDR) solutions to monitor for Cobalt Strike and Mimikatz activity
• Conduct user training on phishing awareness to mitigate potential spear-phishing attempts
• Encrypt backups and ensure they are air-gapped from the network
• Monitor for unusual lateral movement activities within the network

Suggested Tags