Wizard Spider Threat Profile

Russian cybercrime group behind TrickBot, Conti, Ryuk, and BazarLoader - one of the most prolific ransomware operations generating $200M+ in revenue. This profile is mapped to MITRE ATT&CK G0102 and covers attribution, tooling, targeting, and defensive recommendations based on observed campaigns.

Overview & Attribution

Wizard Spider (also tracked as Grim Spider, FIN12, GOLD BLACKBURN, ITG23) is a threat group attributed to Russia. The group primarily targets Healthcare, government, enterprise globally for intelligence collection and operational objectives aligned with state interests.

Arsenal & Tools

Known tools and malware associated with Wizard Spider include:

• TrickBot
• Conti
• Ryuk
• BazarLoader
• Anchor

Targeting & Operations

Wizard Spider operations focus on Healthcare, government, enterprise globally. The group typically gains initial access through spear-phishing, exploitation of public-facing applications, or strategic web compromises before deploying custom implants for persistent access and data exfiltration.

MITRE ATT&CK Mapping

Key techniques observed in Wizard Spider operations:

Full ATT&CK mapping: https://attack.mitre.org/groups/G0102/

Notable Campaigns

This threat group has been active in operations targeting Healthcare, government, enterprise globally. Security researchers have documented campaigns involving TrickBot and other tools deployed against organizations in multiple countries. Attribution confidence varies by campaign, but consistent infrastructure and TTP overlap links activity to Russia-nexus operations.

Detection & Defense

Recommended defensive measures against Wizard Spider:

• Network monitoring: Detect C2 beaconing patterns associated with TrickBot and related implants
• Endpoint detection: Deploy behavioral rules for the ATT&CK techniques above, particularly T1486 and T1059.001
• Email security: Implement robust phishing defenses including URL sandboxing and attachment detonation
• Patch management: Prioritize patching of internet-facing applications exploited by this group
• Threat hunting: Proactively hunt for IOCs and behavioral indicators mapped to G0102 in MITRE ATT&CK

How Mjolnir Security Can Help