Wizard Spider - G0102

Created: 2020-05-12T18:15:29.396Z

Modified: 2023-03-22T05:44:27.289Z

Contributors: Edward Millington,Oleksiy Gayda

Aliases

Wizard Spider,UNC1878,TEMP.MixMaster,Grim Spider

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)

Techniques Used

Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit,

Empire,

Mimikatz.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1222.001|Windows File and Directory Permissions Modification|

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.003|Code Signing Certificates|