WIZARD SPIDER

Also known as

TEMP.MixMaster, GOLD BLACKBURN, FIN12, Periwinkle Tempest, DEV-0193, Storm-0193, Trickbot LLC, UNC2053, Pistachio Tempest, DEV-0237, Storm-0230

Description

Wizard Spider is reportedly associated with Grim Spider and Lunar Spider. The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPIDER appears to be a subset. The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot (aka IcedID), which was first observed in April 2017. The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud, through the use of webinjects and a malware distribution function. GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past.

Techniques by tactic

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to WIZARD SPIDER today — this states the absence of a published link, not that WIZARD SPIDER has no infrastructure.

References

• https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/
• https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
• https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/
• https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module/
• https://www.crowdstrike.com/blog/wizard-spider-adds-new-feature-to-ryuk-ransomware/
• https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
• https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
• https://www.secureworks.com/research/threat-profiles/gold-ulrick
• https://www.secureworks.com/research/dyre-banking-trojan
• https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic
• https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users
• http://www.secureworks.com/research/threat-profiles/gold-blackburn
• https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf
• https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf
• https://securityintelligence.com/posts/itg23-crypters-cooperation-between-cybercriminal-groups/
• https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/

Related pages

Pivot from WIZARD SPIDER into its techniques, tactics and any attributed infrastructure.

• Whisper Internet Directory · Home
• TLD · .com
• Live MOAS conflicts
• ATT&CK technique · T1003.001
• Browse all threat actors
• Browse ATT&CK techniques and tactics

Queries

MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25

MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000

MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25

Or query Whisper from your own LLM workflow via the Whisper MCP server.