MITRE ATT&CKgroup

G0102 Wizard Spider

Published 2020-05-12 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Aliases
UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237
Version
4.1
Created
2020-05-12

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Related

Uses · MITRE ATT&CK (86)

  • T1685 Disable or Modify Tools technique
  • S9001 SystemBC software (malware)
  • T1518.002 Backup Software Discovery sub-technique
  • S1071 Rubeus software (tool)
  • T1027.010 Command Obfuscation sub-technique
  • S0659 Diavol software (malware)
  • S0632 GrimAgent software (malware)
  • S0575 Conti software (malware)
  • S0552 AdFind software (tool)
  • T1555.004 Windows Credential Manager sub-technique
  • S0534 Bazar software (malware)
  • S0521 BloodHound software (tool)
  • T1585.002 Email Accounts sub-technique
  • T1588.002 Tool sub-technique
  • T1588.003 Code Signing Certificates sub-technique
  • S0504 Anchor software (malware)
  • S0446 Ryuk software (malware)
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1569.002 Service Execution sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
Show all 86 ›

References