Wizard Spider

Threat Actors · Wizard Spider

· ATT&CK GroupG0102

UNC1878TEMP.MixMasterGrim SpiderFIN12GOLD BLACKBURNITG23Periwinkle TempestDEV-0193Pistachio TempestDEV-0237

Techniques

Software

Tactics

Aliases

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)

Tactic Coverage

persistence (11)stealth (9)discovery (8)execution (8)privilege escalation (8)credential access (7)lateral movement (7)collection (5)initial access (5)defense impairment (4)exfiltration (3)resource development (3)command and control (2)impact (2)

Techniques Used (64)

T1003.001LSASS Memory

credential access

T1003.002Security Account Manager

credential access

T1003.003NTDS

credential access

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 64 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (22)

S0552AdFindtool S0504Anchormalware S0190BITSAdmintool S0534Bazarmalware S0521BloodHoundtool S0154Cobalt Strikemalware S0575Contimalware S0659Diavol

References (20)

https://attack.mitre.org/groups/G0102 https://us-cert.cisa.gov/ncas/alerts/aa20-302a https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest https://www.crowdstrike.com/blog/wizard-spider-adversary-update/https://www.secureworks.com/research/threat-profiles/gold-blackburn