# GRIM SPIDER: threat group profile

> GRIM SPIDER is a threat group. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/grim-spider
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > GRIM SPIDER

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Thought to operate from | Not known |
| Other names | 1 |
| Public reports | 2 |

## Who is GRIM SPIDER?

GRIM SPIDER is a threat group. Public reporting about it is still limited.

### Also known as

GOLD ULRICK

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past. Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD. Grim Spider is reportedly associated with Lunar Spider and Wizard Spider.

## Public reports about GRIM SPIDER

- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html

## Frequently asked questions

### Who is GRIM SPIDER?

GRIM SPIDER is a threat group. Public reporting about it is still limited.

### How do I know if GRIM SPIDER is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact