Início / Grupos de ameaça / Wizard Spider

Wizard Spider G0102

🔔 Criar alerta

Também conhecido como: UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

82

Técnicas

22

Malwares e ferramentas

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Operações de ransomware ligadas a este grupo ransomware.live

conti via Conti diavol via Diavol

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2020-1472 Média · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.”

Técnicas por tática

Desenvolvimento de recursos

T1585.002 Email Accounts T1588.002 Tool T1588.003 Code Signing Certificates

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1197 BITS Jobs T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1133 External Remote Services T1136.001 Local Account T1136.002 Domain Account T1197 BITS Jobs T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL

Escalada de privilégios

T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1078 Valid Accounts T1078.002 Domain Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL

Furtividade

T1027.010 Command Obfuscation T1036.004 Masquerade Task or Service T1055 Process Injection T1055.001 Dynamic-link Library Injection T1070.004 File Deletion T1078 Valid Accounts T1078.002 Domain Accounts T1197 BITS Jobs T1218.011 Rundll32

Comprometimento de defesas

T1112 Modify Registry T1222.001 Windows Permissions T1553.002 Code Signing T1685 Disable or Modify Tools

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1552.006 Group Policy Preferences T1555.004 Windows Credential Manager T1557.001 Name Resolution Poisoning and SMB Relay T1558.003 Kerberoasting

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1087.002 Domain Account T1135 Network Share Discovery T1518.001 Security Software Discovery T1518.002 Backup Software Discovery

Movimento lateral

T1021 Remote Services T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1210 Exploitation of Remote Services T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Coleta

T1005 Data from Local System T1074 Data Staged T1074.001 Local Data Staging T1557.001 Name Resolution Poisoning and SMB Relay T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1105 Ingress Tool Transfer

Exfiltração

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1567.002 Exfiltration to Cloud Storage

Impacto

T1489 Service Stop T1490 Inhibit System Recovery

Malwares e ferramentas

AnchorMalwareS0504
BazarMalwareS0534
Cobalt StrikeMalwareS0154
ContiMalwareS0575
DiavolMalwareS0659
DyreMalwareS0024
EmotetMalwareS0367
GrimAgentMalwareS0632
RyukMalwareS0446
SystemBCMalwareS9001
TrickBotMalwareS0266
AdFindFerramentaS0552
BITSAdminFerramentaS0190
BloodHoundFerramentaS0521
EmpireFerramentaS0363
LaZagneFerramentaS0349
MimikatzFerramentaS0002
NetFerramentaS0039
NltestFerramentaS0359
PingFerramentaS0097
PsExecFerramentaS0029
RubeusFerramentaS1071

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.