CrowdStrike® Intelligence monitors the eCrime ecosystem by tracking eCrime organizations, independent threat actors, and their relationships. For example, the creator of Samas (aka Sam Sam) was identified as a threat actor named BOSS SPIDER; INDRIK SPIDER was credited with the creation of Dridex; and WIZARD SPIDER, also known as the Russia-based operator of the TrickBot banking malware — which in the past had focused primarily on wire fraud — was identified as the group that created Ryuk. These groups have been observed propagating ransomware attacks that are part of the BGH trend and raking in huge profits through targeted attacks that reap big rewards. For instance, since its initial appearance in 2016 until its last known activity toward the end of 2018, BOSS SPIDER has taken in more than $6.7 million USD. Since WIZARD SPIDER’s initial appearance in August 2018, this threat actor group is estimated to have netted over 695.80 Bitcoin across 51 transactions, with an approximate value of $3.6 million USD.