Wizard Spider

Overview

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Naming & attribution

Wizard Spider is tracked under 11 names across the industry. It uses 64 documented ATT&CK techniques — more than 90% of the 174 groups tracked here. Activity attributed since at least 2016.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1518.002 Backup Software Discovery — used by 1 of 174 groups
• T1222.001 Windows Permissions — used by 2 of 174 groups
• T1552.006 Group Policy Preferences — used by 2 of 174 groups
• T1557.001 Name Resolution Poisoning and SMB Relay — used by 2 of 174 groups
• T1021 Remote Services — used by 3 of 174 groups
• T1547.004 Winlogon Helper DLL — used by 3 of 174 groups
• T1558.003 Kerberoasting — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT41 China — 37 shared techniques (34% overlap)
• FIN8 — 25 shared techniques (33% overlap)
• Medusa Group — 29 shared techniques (32% overlap)
• BlackByte — 27 shared techniques (32% overlap)
• Aquatic Panda China — 23 shared techniques (30% overlap)
• Chimera China — 28 shared techniques (29% overlap)

Targets

Defense · Finance · Government · Healthcare · Telecommunications

Regions

Australia · Bahamas · Canada · Costa Rica · France · Germany · India · Ireland · Italy · Japan · Mexico · New Zealand · Spain · Switzerland · Taiwan · Ukraine · United Kingdom · United States

Capabilities

• Custom malware/implant development — ATT&CK: 11 attributed custom malware families

TTPs — 64 techniques across 13 tactics

Tools & malware (22)

TrickBot · AdFind · BITSAdmin · SystemBC · BloodHound · Ping · Bazar · LaZagne · Nltest · GrimAgent · Dyre · Ryuk · Conti · Emotet · Rubeus · Mimikatz · Anchor · Diavol · Net · Empire · PsExec · Cobalt Strike

Reporting (3)

• Financially Motivated Threat Actor Pistachio Tempest — Microsoft
• How Microsoft names threat actors — Microsoft
• Gold Blackburn Threat Profile — Secureworks Counter Threat Unit