Circus Spider
Circus Spider is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 6 sectors, including Government and Manufacturing, in 35 countries, including the United States and India.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Record updated
Who They Target.
Arsenal · Malware And Tools.
- Netwalkermalware
About Circus Spider.
(Carbon Black) MailTo is a ransomware variant that has recently been reported to have been part of a targeted attack against Toll Group, an Australian freight and logistics company. This ransomware makes no attempt to remain stealthy, and quickly encrypts the user’s data as soon as the ransomware is launched. Once the encryption phase completes, the encrypted files are renamed to contain the word “mailto”, which is where the name originated from.
Last updated Oct 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.