Stripedfly

StripedFly is a malicious threat actor that has been active since at least April 9, 2016, as indicated by the earliest known version of StripedFly incorporating the EternalBlue exploit. The authors behind StripedFly show parallels with the EternalBlue exploit, which is notorious for its use in widespread cyber attacks. This group's activities remained undetected until August 24, 2017, over a year after their initial appearance, demonstrating their ability to operate covertly and effectively. The StripedFly malware exhibits similarities to the ThunderCrypt ransomware in terms of functionality and modules, suggesting a possible connection or shared origin between the two. This overlap may indicate that the group behind StripedFly could also be responsible for the development or deployment of ThunderCrypt. However, as of now, the precise identity of the individuals or entities behind StripedFly remains unknown. By October 2023, StripedFly had reportedly infected over 1 million PCs, highlighting its significant reach and impact. Despite this widespread infection, the cybersecurity industry continues to struggle in definitively attributing the malware to a specific source. As such, ongoing vigilance and robust defensive measures are critical to mitigate the threat posed by this elusive and potent threat actor.