Blind Spider

Blind Spider is a financially motivated threat actor identified by CrowdStrike as one of six major operators targeting Latin America, alongside Ocular Spider, Odyssey Spider, Plump Spider, Samba Spider, and Squab Spider. CrowdStrike states these operators are either based in Latin America or primarily focused on targets in the region. The provided content also notes Blind Spider is also known as Blind Eagle. Separately, Sophos assessed that malware campaigns involving the HeartCrypt packer-as-a-service were not attributable to Blind Spider alone: although HeartCrypt activity had some geographic overlap with cases CrowdStrike tracks as Blind Spider, Sophos found sufficient differences in payloads, injection mechanisms, and targeted locations to conclude multiple threat actors were using HeartCrypt rather than a single actor such as Blind Spider. The content further states that Blind Spider has been cited among threat actors that have leveraged AI in their operations. No additional high-confidence targeting, tooling, or TTP details specific to Blind Spider are directly provided in the source content.