CybercrimeFinancial gainATT&CK G0102

Wizard Spider

Also known as: UNC1878, Grim Spider, FIN12, GOLD BLACKBURN, Periwinkle Tempest, DEV-0193

Wizard Spider created the TrickBot malware and used it as a foothold for ransomware such as Ryuk and Conti. Its intrusions follow a pattern defenders should know well: phishing, then credential theft and Kerberoasting, then lateral movement over SMB, then deleting backups and encrypting the network.

Public attribution: A Russia-based, financially motivated group (MITRE ATT&CK).
Active since: Around 2016
Targets: Large companies
Hospitals and healthcare providers
Government agencies

Notable campaigns

2016 onwardTrickBot
Development and operation of the TrickBot banking trojan, later a ransomware delivery platform.
2020Ransomware against US healthcare
CISA, FBI and HHS warned of an imminent threat to hospitals from Ryuk and Conti delivered via TrickBot and BazarLoader.

Signature ATT&CK techniques

Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.

Defences that work against this actor

Use long random service-account passwords or managed service accounts; alert on RC4 Kerberos ticket requests.
Block SMB and WMI between workstations; only admin hosts should reach admin shares.
Keep offline backups that domain admins cannot delete.
Treat any TrickBot or loader detection as a pre-ransomware incident, not just malware cleanup.

Learn and practise on CyberCertPrep

Haxplain: Kerberoasting Ransomware triage lab Glossary: lateral movement

Sources

Defences that work against this actor

Use long random service-account passwords or managed service accounts; alert on RC4 Kerberos ticket requests.

Block SMB and WMI between workstations; only admin hosts should reach admin shares.

Keep offline backups that domain admins cannot delete.

Treat any TrickBot or loader detection as a pre-ransomware incident, not just malware cleanup.