Home / Threat actors / Wizard Spider

Wizard Spider G0102

🔔 Create alert

Also known as: UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

82

Techniques

22

Malware and tools

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Ransomware operations linked to this group ransomware.live

conti via Conti diavol via Diavol

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.”

Techniques by tactic

Resource Development

T1585.002 Email Accounts T1588.002 Tool T1588.003 Code Signing Certificates

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1136.002 Domain Account T1197 BITS Jobs T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL

Privilege Escalation

T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1078 Valid Accounts T1078.002 Domain Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL

Stealth

T1027.010 Command Obfuscation T1036.004 Masquerade Task or Service T1055 Process Injection T1055.001 Dynamic-link Library Injection T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1197 BITS Jobs T1218.011 Rundll32

Defense Impairment

T1112 Modify Registry T1222.001 Windows Permissions T1553.002 Code Signing T1685 Disable or Modify Tools

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1552.006 Group Policy Preferences T1555.004 Windows Credential Manager T1557.001 Name Resolution Poisoning and SMB Relay T1558.003 Kerberoasting

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1087.002 Domain Account T1135 Network Share Discovery T1518.001 Security Software Discovery T1518.002 Backup Software Discovery

Lateral Movement

T1021 Remote Services T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1210 Exploitation of Remote Services T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1074 Data Staged T1074.001 Local Data Staging T1557.001 Name Resolution Poisoning and SMB Relay T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1567.002 Exfiltration to Cloud Storage

Impact

T1489 Service Stop T1490 Inhibit System Recovery

Malware and tools

AnchorMalwareS0504
BazarMalwareS0534
Cobalt StrikeMalwareS0154
ContiMalwareS0575
DiavolMalwareS0659
DyreMalwareS0024
EmotetMalwareS0367
GrimAgentMalwareS0632
RyukMalwareS0446
SystemBCMalwareS9001
TrickBotMalwareS0266
AdFindToolS0552
BITSAdminToolS0190
BloodHoundToolS0521
EmpireToolS0363
LaZagneToolS0349
MimikatzToolS0002
NetToolS0039
NltestToolS0359
PingToolS0097
PsExecToolS0029
RubeusToolS1071

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.