- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Sponsor
- Russian Federation
- Motivation
- Financial crime; Financial gain
- Seen
- 2014–2026
- Status
- Active
- ATT&CK
- G0102 · 64 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0107 · wizard-spider
RussiaWhat it is
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- GRIM SPIDER
- IBM X-Force
- ITG23
- Mandiant
- FIN12, UNC1878, TEMP.MixMaster, UNC2053
- Microsoft
- Periwinkle Tempest, Pistachio Tempest, Storm-0230, DEV-0193, DEV-0237, Storm-0193
- MITRE ATT&CK
- G0102
- Secureworks
- GOLD BLACKBURN
- Operations
- Operation “BazaFlix”
- Other names
- Conti, Ryuk, Conti Team 1, Gold Ulrick, Trickbot LLC, Wizard Spider, Gold Blackburn
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia
Targets
- Countries
- Australia, Bahamas, Canada, Colombia, Costa Rica, France, Germany, India, Indonesia, Ireland, Italy, Japan, Mexico, New Zealand, Philippines, South Korea, Spain, Switzerland, Taiwan, Ukraine, United Arab Emirates, United Kingdom, United States
- Sectors
- Critical Infrastructure, Defense, Education, Financial, Government, Healthcare, Manufacturing, Technology, Telecommunications
Tools
The tools and malware families the sources tie to it.
- AdFind
- Anchor
- BITSAdmin
- BLACKCOFFEE
- Bazar
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- BloodHound
- Cobalt Strike
- Conti
- CrossRat
- Cyber Eye RAT
- CyberGate
- Diavol
- Dyre
- Emotet
- Empire
- GrimAgent
- LaZagne
- Mimikatz
- Net
- Nltest
- Ping
- PsExec
- Revenge-RAT
- Rubeus
- Ryuk
- SystemBC
- TURNEDUP
- TrickBot
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de