PROPHET SPIDER

A financially motivated initial-access broker tracked by CrowdStrike since at least 2017. It exploits public-facing web applications and enterprise servers, establishes persistent access, and sells or transfers that access to other criminals, including ransomware operators.