Loading IOCs…

{'aliases': ['Wizard Spider',
             'UNC1878',
             'TEMP.MixMaster',
             'Grim Spider',
             'FIN12',
             'GOLD BLACKBURN',
             'ITG23',
             'Periwinkle Tempest',
             'DEV-0193'],
 'created': '2020-05-12T18:15:29.396Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Wizard Spider](https://attack.mitre.org/groups/G0102) is a '
                'Russia-based financially motivated threat group originally '
                'known for the creation and deployment of '
                '[TrickBot](https://attack.mitre.org/software/S0266) since at '
                'least 2016. [Wizard '
                'Spider](https://attack.mitre.org/groups/G0102) possesses a '
                'diverse arsenal of tools and has conducted ransomware '
                'campaigns against a variety of organizations, ranging from '
                'major corporations to hospitals.(Citation: CrowdStrike Ryuk '
                'January 2019)(Citation: DHS/CISA Ransomware Targeting '
                'Healthcare October 2020)(Citation: CrowdStrike Wizard Spider '
                'October 2020)',
 'external_references': [{'external_id': 'G0102',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0102'},
                         {'description': '(Citation: CrowdStrike Ryuk January '
                                         '2019)(Citation: CrowdStrike Grim '
                                         'Spider May 2019)',
                          'source_name': 'Grim Spider'},
                         {'description': '(Citation: FireEye KEGTAP SINGLEMALT '
                                         'October 2020)',
                          'source_name': 'UNC1878'},
                         {'description': '(Citation: FireEye Ryuk and Trickbot '
                                         'January 2019)',
                          'source_name': 'TEMP.MixMaster'},
                         {'description': '(Citation: IBM X-Force ITG23 Oct '
                                         '2021)',
                          'source_name': 'ITG23'},
                         {'description': '(Citation: Mandiant FIN12 Oct 2021)',
                          'source_name': 'FIN12'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'Periwinkle Tempest'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)',
                          'source_name': 'DEV-0193'},
                         {'description': '(Citation: Secureworks Gold '
                                         'Blackburn Mar 2022)',
                          'source_name': 'GOLD BLACKBURN'},
                         {'description': 'DHS/CISA. (2020, October 28). '
                                         'Ransomware Activity Targeting the '
                                         'Healthcare and Public Health Sector. '
                                         'Retrieved October 28, 2020.',
                          'source_name': 'DHS/CISA Ransomware Targeting '
                                         'Healthcare October 2020',
                          'url': 'https://us-cert.cisa.gov/ncas/alerts/aa20-302a'},
                         {'description': 'Goody, K., et al (2019, January 11). '
                                         'A Nasty Trick: From Credential Theft '
                                         'Malware to Business Disruption. '
                                         'Retrieved May 12, 2020.',
                          'source_name': 'FireEye Ryuk and Trickbot January '
                                         '2019',
                          'url': 'https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html'},
                         {'description': 'Hanel, A. (2019, January 10). Big '
                                         'Game Hunting with Ryuk: Another '
                                         'Lucrative Targeted Ransomware. '
                                         'Retrieved May 12, 2020.',
                          'source_name': 'CrowdStrike Ryuk January 2019',
                          'url': 'https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/'},
                         {'description': 'John, E. and Carvey, H. (2019, May '
                                         '30). Unraveling the Spiderweb: '
                                         'Timelining ATT&CK Artifacts Used by '
                                         'GRIM SPIDER. Retrieved May 12, 2020.',
                          'source_name': 'CrowdStrike Grim Spider May 2019',
                          'url': 'https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/'},
                         {'description': 'Kimberly Goody, Jeremy Kennelly, '
                                         'Joshua Shilko, Steve Elovitz, '
                                         'Douglas Bienstock. (2020, October '
                                         '28). Unhappy Hour Special: KEGTAP '
                                         'and SINGLEMALT With a Ransomware '
                                         'Chaser. Retrieved October 28, 2020.',
                          'source_name': 'FireEye KEGTAP SINGLEMALT October '
                                         '2020',
                          'url': 'https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
                         {'description': 'Podlosky, A., Hanel, A. et al. '
                                         '(2020, October 16). WIZARD SPIDER '
                                         'Update: Resilient, Reactive and '
                                         'Resolute. Retrieved June 15, 2021.',
                          'source_name': 'CrowdStrike Wizard Spider October '
                                         '2020',
                          'url': 'https://www.crowdstrike.com/blog/wizard-spider-adversary-update/'},
                         {'description': 'Secureworks Counter Threat Unit. '
                                         '(2022, March 1). Gold Blackburn '
                                         'Threat Profile. Retrieved June 15, '
                                         '2023.',
                          'source_name': 'Secureworks Gold Blackburn Mar 2022',
                          'url': 'https://www.secureworks.com/research/threat-profiles/gold-blackburn'},
                         {'description': 'Shilko, J., et al. (2021, October '
                                         '7). FIN12: The Prolific Ransomware '
                                         'Intrusion Threat Actor That Has '
                                         'Aggressively Pursued Healthcare '
                                         'Targets. Retrieved June 15, 2023.',
                          'source_name': 'Mandiant FIN12 Oct 2021',
                          'url': 'https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf'},
                         {'description': 'Villadsen, O., et al. (2021, October '
                                         '13). Trickbot Rising - Gang Doubles '
                                         'Down on Infection Efforts to Amass '
                                         'Network Footholds. Retrieved June '
                                         '15, 2023.',
                          'source_name': 'IBM X-Force ITG23 Oct 2021',
                          'url': 'https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/'}],
 'id': 'intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7',
 'modified': '2025-03-12T20:33:21.597Z',
 'name': 'Wizard Spider',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Edward Millington', 'Oleksiy Gayda'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'ics-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '4.0'}