Automation · API / MCP 中文

Group profile · G0102

Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

ATT&CK G0102 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2020

Showing 2020 citations only; facet pages stay out of the index and canonicalise to the profile.

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.123

  1. CrowdStrike Ryuk January 2019
  2. DHS/CISA Ransomware Targeting Healthcare October 2020
  3. CrowdStrike Wizard Spider October 2020

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
uses_techniquetech_t1136.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t12102020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1543.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10742020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10552020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10212020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1550.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1222.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t15702020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0102020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0062020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1518.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0112020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1558.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t11122020 → …100src_mitre_attck_enterprise
uses_techniquetech_t14902020 → …100src_mitre_attck_enterprise
uses_techniquetech_t11332020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0042020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0042020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1518.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1136.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1557.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0032020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10162020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10332020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10782020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t14892020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052020 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0042020 → …100src_mitre_attck_enterprise
uses_techniquetech_t11352020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1569.0022020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0062020 → …100src_mitre_attck_enterprise
uses_techniquetech_t1055.0012020 → …100src_mitre_attck_enterprise
uses_techniquetech_t11972020 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1003.001LSASS Memory—
T1003.002Security Account Manager—
T1003.003NTDS—
T1005Data from Local System—
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1021Remote Services—
T1021.001Remote Desktop Protocol—
T1021.002SMB/Windows Admin Shares—
T1021.006Windows Remote Management—
T1027.010Command Obfuscation—
T1033System Owner/User Discovery—
T1036.004Masquerade Task or Service—
T1041Exfiltration Over C2 Channel—
T1047Windows Management Instrumentation—
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol—
T1053.005Scheduled Task—
T1055Process Injection—
T1055.001Dynamic-link Library Injection—
T1059.001PowerShell—
T1059.003Windows Command Shell—
T1070.004File Deletion—
T1071.001Web Protocols—
T1074Data Staged—
T1074.001Local Data Staging—
T1078Valid Accounts—
T1078.002Domain Accounts—
T1082System Information Discovery—
T1087.002Domain Account—
T1105Ingress Tool Transfer—
T1112Modify Registry—
T1133External Remote Services—
T1135Network Share Discovery—
T1136.001Local Account—
T1136.002Domain Account—
T1197BITS Jobs—
T1204.001Malicious Link—
T1204.002Malicious File—
T1210Exploitation of Remote Services—
T1218.011Rundll32—
T1222.001Windows Permissions—
T1489Service Stop—
T1490Inhibit System Recovery—
T1518.001Security Software Discovery—
T1518.002Backup Software Discovery—
T1543.003Windows Service—
T1547.001Registry Run Keys / Startup Folder—
T1547.004Winlogon Helper DLL—
T1550.002Pass the Hash—
T1552.006Group Policy Preferences—
T1553.002Code Signing—
T1555.004Windows Credential Manager—
T1557.001Name Resolution Poisoning and SMB Relay—
T1558.003Kerberoasting—
T1560.001Archive via Utility—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1567.002Exfiltration to Cloud Storage—
T1569.002Service Execution—
T1570Lateral Tool Transfer—
T1585.002Email Accounts—
T1588.002Tool—
T1588.003Code Signing Certificates—
T1685Disable or Modify Tools—

Aliases

DEV-0193 · DEV-0237 · FIN12 · GOLD BLACKBURN · Grim Spider · ITG23 · Periwinkle Tempest · Pistachio Tempest · TEMP.MixMaster · UNC1878 · Wizard Spider

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections