State-backedRussia MITRE G0102

WIZARD SPIDER

Also known as TEMP.MixMaster, GOLD BLACKBURN, FIN12, Periwinkle Tempest, DEV-0193, Storm-0193, Trickbot LLC, UNC2053, Pistachio Tempest, DEV-0237, Storm-0230, UNC1878, Grim Spider, ITG23

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Wizard Spider is reportedly associated with Grim Spider and Lunar Spider. The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPIDER appears to be a subset. The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot (aka IcedID), which was first observed in April 2017. The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud, through the use of webinjects and a malware distribution function. GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past.

Targets: Defense, Financial, Government, Healthcare, Telecommunications, Australia, Bahamas, Canada, Costa Rica, France, Germany, India, Ireland, Italy, Japan

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1005 Data from Local System T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021 Remote Services T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1027.010 Command Obfuscation T1033 System Owner/User Discovery T1036.004 Masquerade Task or Service T1041 Exfiltration Over C2 Channel T1047 Windows Management Instrumentation T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1059.001 PowerShell T1059.003 Windows Command Shell T1070.004 File Deletion T1071.001 Web Protocols T1074 Data Staged T1074.001 Local Data Staging T1078 Valid Accounts T1078.002 Domain Accounts T1082 System Information Discovery T1087.002 Domain Account T1105 Ingress Tool Transfer T1112 Modify Registry T1133 External Remote Services T1135 Network Share Discovery T1136.001 Local Account T1136.002 Domain Account T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1210 Exploitation of Remote Services T1218.011 Rundll32 T1222.001 Windows Permissions T1489 Service Stop T1490 Inhibit System Recovery T1518.001 Security Software Discovery T1518.002 Backup Software Discovery T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL T1550.002 Pass the Hash T1552.006 Group Policy Preferences T1553.002 Code Signing T1555.004 Windows Credential Manager T1557.001 Name Resolution Poisoning and SMB Relay T1558.003 Kerberoasting T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1567.002 Exfiltration to Cloud Storage T1569.002 Service Execution T1570 Lateral Tool Transfer T1585.002 Email Accounts T1588.002 Tool T1588.003 Code Signing Certificates T1685 Disable or Modify Tools

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.