Wizard Spider
View MITRE Group Page ↗Key Facts
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G0102 (Wizard Spider).
- Linked to 2 primary court prosecution record(s) with $308.0 million documented loss.
- Identified 2 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1566.001 Spearphishing Attachment | 1 incidents |
| T1003 OS Credential Dumping | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1055 Process Injection | 1 incidents |
Prosecution Cases Attributed to Wizard Spider
U.S. v. Alla Witte & Vladimir Dunaev (Trickbot Malware Group)
Key software developers and coders of the transnational Trickbot cybercrime group charged with infecting millions of victim computers with banking trojans and facilitating Conti/Ryuk ransomware deployments against hospitals.
Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
Indicted Operatives & Dispositions (2)
Trickbot ransomware management software programmer. Sentenced to 32 months in prison.
Trickbot developer responsible for browser injection modules. Sentenced to 64 months in prison.
Documented TTP Signature for Wizard Spider
Test Controls in Stack Audit →Adversaries send spearphishing emails with malicious attachments to gain initial access to victim systems.
Adversaries dump plaintext passwords and hashes from operating system memory structures such as LSASS.
Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
Adversaries inject malicious code into processes to evade process-based defenses and elevate privileges.