Wizard Spider
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.
- ATT&CK ID
- G0102
- Origin
- Russia
- Weather family
- Tempest
- Techniques
- 49
- Tools
- 22
Also tracked as UNC1878 · TEMP.MixMaster · Grim Spider · FIN12 · GOLD BLACKBURN · ITG23 · Periwinkle Tempest · DEV-0193 · Pistachio Tempest · DEV-0237
Vulnerabilities it has exploited
Techniques
Resource Development
Establish AccountsObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterBITS JobsUser ExecutionSystem Services
Persistence
Scheduled Task/JobValid AccountsModify RegistryExternal Remote ServicesCreate AccountBITS JobsCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionValid AccountsCreate or Modify System ProcessBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionIndicator RemovalValid AccountsBITS JobsSystem Binary Proxy Execution
Defense Impairment
Modify RegistryFile and Directory Permissions ModificationSubvert Trust ControlsDisable or Modify Tools
Credential Access
OS Credential DumpingUnsecured CredentialsCredentials from Password StoresAdversary-in-the-MiddleSteal or Forge Kerberos Tickets
Discovery
System Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoverySystem Information DiscoveryAccount DiscoveryNetwork Share DiscoverySoftware Discovery
Lateral Movement
Remote ServicesExploitation of Remote ServicesUse Alternate Authentication MaterialLateral Tool Transfer
Collection
Data from Local SystemData StagedAdversary-in-the-MiddleArchive Collected Data
Command and Control
Application Layer ProtocolIngress Tool Transfer
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Alternative ProtocolExfiltration Over Web Service
Impact
Service StopInhibit System Recovery
Software
AdFind · Anchor · BITSAdmin · Bazar · BloodHound · Cobalt Strike · Conti · Diavol · Dyre · Emotet · Empire · GrimAgent · LaZagne · Mimikatz · Net · Nltest · Ping · PsExec · Rubeus · Ryuk · SystemBC · TrickBot