Actors/Cybercrime/Unattributed

TA542

G0126CRIME?? · Unattributed

AKA Mealybug · Emotet

CrowdStrike: MUMMY SPIDERMicrosoft: DEV-0184MITRE: G0126Secureworks: GOLD CRESTWOOD

Emotet botnet operators.

Targets12

Sectors6

Threat types1

GIRs mapped0/480

Active since2014

Explore in atlas

Also tracked as

5 vendor names · 2 other aliases

Open Rosetta Stone

CrowdStrike

MUMMY SPIDER

Microsoft

DEV-0184

MITRE

G0126

Proofpoint

TA542

Secureworks

GOLD CRESTWOOD

UNATTRIBUTED ALIASESMealybugEmotet

Victimology

Geographic footprint · 12 countries

Export STIX

origin · unattributedtargeted countries · 12

OCEANIA · 2

Australia · New Zealand

AMERICAS · 2

Canada · United States

EUROPE · 6

Germany · Spain · France · United Kingdom · Italy · Poland

ASIA · 2

Hong Kong · Japan

Sectors targeted

6 of 40

Government100 actors Financial Services73 actors Cryptocurrency20 actors Healthcare46 actors Retail & Hospitality32 actors Hospitality32 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

RAN · Ransomware

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type