Wizard Spider

Origin🇷🇺 Rússia

Techniques (MITRE ATT&CK)64

SourceMITRE ATT&CK

State sponsor: Russian FederationTarget categories: Defense, Financial, Government, Healthcare, Telecommunications

Targeted regions: Australia · Bahamas · Canada · Costa Rica · France · Germany · India · Ireland · Italy · Japan +8

Also known as:DEV-0193DEV-0237FIN12GOLD BLACKBURNGrim SpiderITG23Periwinkle TempestPistachio TempestStorm-0193Storm-0230TEMP.MixMasterTrickbot LLCUNC1878UNC2053

About the group

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity79

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 64

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Email Accounts Tool Code Signing Certificates

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Malicious Link Malicious File Service Execution

Persistence

External Remote Services Local Account Domain Account Windows Service Registry Run Keys / Startup Folder Winlogon Helper DLL

Credential access

LSASS Memory Security Account Manager NTDS Group Policy Preferences Windows Credential Manager Name Resolution Poisoning and SMB Relay Kerberoasting

Discovery

System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Information Discovery Domain Account Network Share Discovery Security Software Discovery Backup Software Discovery

Lateral movement

Remote Services Remote Desktop Protocol SMB/Windows Admin Shares Windows Remote Management Exploitation of Remote Services Pass the Hash Lateral Tool Transfer

Collection

Data from Local System Data Staged Local Data Staging Archive via Utility

Command and control

Web Protocols Ingress Tool Transfer

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration to Cloud Storage

Impact

Service Stop Inhibit System Recovery

defense-impairment

Modify Registry Windows Permissions Code Signing Disable or Modify Tools

stealth

Command Obfuscation Masquerade Task or Service Process Injection Dynamic-link Library Injection File Deletion Valid Accounts Domain Accounts BITS Jobs Rundll32

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2020-1472MEDIUMEPSS 99%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

Known infrastructure 8

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.76.165.219:443SystemBCthreatfox

ip:port45.86.230.112:4001SystemBCthreatfox

domainpaladin5.comSystemBCthreatfox

domainanzo11rikasha22b.pwSystemBCthreatfox

domainkall4234ribk3assa.pwSystemBCthreatfox

ip:port94.232.46.202:4321SystemBCthreatfox

sha256_hash1eb027a9844495e9a3c64bc0c7ea645058933a9b18cc98ff3f42a7b1a9142753SystemBCmalwarebazaar

ip:port34.171.171.32:4001SystemBCthreatfox

References

Wizard Spider uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →