Wizard Spider — ATT&CK profile, 64 techniques

Overview

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Naming & attribution

Wizard Spider is tracked under 11 names across the industry. It uses 64 documented ATT&CK techniques — more than 90% of the 174 groups tracked here. Activity attributed since at least 2016.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
UNC1878	Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock
Grim Spider	Hanel, A
FIN12	Shilko, J., et al
GOLD BLACKBURN	Secureworks Counter Threat Unit
ITG23	Villadsen, O., et al
Periwinkle Tempest	Microsoft
DEV-0193	Microsoft
Pistachio Tempest	Microsoft
DEV-0237	Microsoft

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1518.002 Backup Software Discovery — used by 1 of 174 groups
T1222.001 Windows Permissions — used by 2 of 174 groups
T1552.006 Group Policy Preferences — used by 2 of 174 groups
T1557.001 Name Resolution Poisoning and SMB Relay — used by 2 of 174 groups
T1021 Remote Services — used by 3 of 174 groups
T1547.004 Winlogon Helper DLL — used by 3 of 174 groups
T1558.003 Kerberoasting — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT41 China — 37 shared techniques (34% overlap)
FIN8 — 25 shared techniques (33% overlap)
Medusa Group — 29 shared techniques (32% overlap)
BlackByte — 27 shared techniques (32% overlap)
Aquatic Panda China — 23 shared techniques (30% overlap)
Chimera China — 28 shared techniques (29% overlap)

Malware families with current indicators

8 families attributed to Wizard Spider, carrying 1,016 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

Emotet 491 indicators
SystemBC 296 indicators
Conti 161 indicators
Ryuk 42 indicators
Rubeus 12 indicators
Anchor 5 indicators
Trickbot 4 indicators
Diavol 3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Defense · Finance · Government · Healthcare · Telecommunications

Regions

Australia · Bahamas · Canada · Costa Rica · France · Germany · India · Ireland · Italy · Japan · Mexico · New Zealand · Spain · Switzerland · Taiwan · Ukraine · United Kingdom · United States

Capabilities

Custom malware/implant development — ATT&CK: 11 attributed custom malware families

TTPs — 64 techniques across 13 tactics

Defense Impairment

Credential Access

T1003.001 LSASS Memory
T1003.002 Security Account Manager
T1003.003 NTDS
T1552.006 Group Policy Preferences
T1555.004 Windows Credential Manager
T1557.001 Name Resolution Poisoning and SMB Relay
T1558.003 Kerberoasting

Discovery

T1016 System Network Configuration Discovery
T1018 Remote System Discovery
T1033 System Owner/User Discovery
T1082 System Information Discovery
T1087.002 Domain Account
T1135 Network Share Discovery
T1518.001 Security Software Discovery
T1518.002 Backup Software Discovery

Lateral Movement

Collection

Command and Control

T1071.001 Web Protocols
T1105 Ingress Tool Transfer

Exfiltration

T1041 Exfiltration Over C2 Channel
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
T1567.002 Exfiltration to Cloud Storage

Impact

T1489 Service Stop
T1490 Inhibit System Recovery

Tools & malware (22)

TrickBot · AdFind · BITSAdmin · SystemBC · BloodHound · Ping · Bazar · LaZagne · Nltest · GrimAgent · Dyre · Ryuk · Conti · Emotet · Rubeus · Mimikatz · Anchor · Diavol · Net · Empire · PsExec · Cobalt Strike

Reporting (3)

Financially Motivated Threat Actor Pistachio Tempest — Microsoft
How Microsoft names threat actors — Microsoft
Gold Blackburn Threat Profile — Secureworks Counter Threat Unit