WIZARD SPIDER

Wizard Spider is a Russian-speaking financially motivated cybercriminal threat actor best known for operating and developing the TrickBot malware ecosystem and for ransomware operations associated with Ryuk and Conti. The group is widely tracked under numerous aliases including TrickBot Gang, FIN12, UNC1878, UNC2053, ITG23, Gold Blackburn, Gold Ulrick, Grim Spider, TEMP.MixMaster, Storm-0230, Periwinkle Tempest, Pistachio Tempest, DEV-0193, DEV-0237, and G0102. In some reporting, FIN12 is treated as a closely related cluster or operational subset focused on rapid ransomware monetization. Wizard Spider has primarily targeted enterprises, healthcare organizations, government entities, and other large networks where disruption can produce high-value extortion outcomes. The group became especially prominent through major ransomware intrusions, including the use of Conti against healthcare environments, and has been linked to large-scale financially motivated campaigns causing severe operational disruption. Operationally, Wizard Spider is associated with a mature eCrime intrusion model that combines initial access, malware staging, credential theft, internal reconnaissance, lateral movement, and ransomware deployment. The group has leveraged the TrickBot ecosystem as a modular access and post-compromise platform and has also been associated with use of supporting malware and access tooling seen across the ransomware ecosystem, including SystemBC as a proxy/backdoor component. Reporting has also linked ex-Conti or Conti-adjacent activity to tooling such as Domino and Dave Loader in broader criminal collaboration patterns. Observed tradecraft includes persistence through Windows autostart mechanisms such as Registry Run keys and Startup folder shortcuts; credential access through modification of WDigest settings to force plaintext credential material into memory; host and Active Directory reconnaissance using native utilities and PowerShell cmdlets; security software discovery via WMI and related system interfaces; and PowerShell-based execution. Wizard Spider has also been associated with process injection and exploitation for privilege escalation in ATT&CK-aligned reporting. The actor’s malware-enabled reconnaissance commonly includes collection of detailed system configuration data, operating system information, hostnames, logon metadata, and domain-related information from Active Directory environments. This reflects a pattern of hands-on-keyboard post-compromise activity designed to identify valuable systems, evade defenses, and accelerate ransomware deployment. Wizard Spider is commonly assessed as part of the Russian-speaking cybercrime ecosystem rather than a state intelligence service. However, the group’s infrastructure, personnel overlaps, and downstream collaborations have frequently intersected with other major eCrime actors. Conti’s internal leak and subsequent fragmentation contributed to the emergence or reorganization of multiple successor or affiliated clusters. Some reporting has described Akira as closely related to Conti code and sometimes considered a Wizard Spider-linked subgroup, but such subgroup characterizations are not uniformly established and should be treated cautiously. Overall, Wizard Spider is one of the most consequential ransomware and malware operators of the modern eCrime landscape, distinguished by its role in the TrickBot-to-Ryuk-to-Conti continuum, aggressive enterprise targeting, and extensive use of credential theft, reconnaissance, persistence, and post-exploitation tradecraft to enable large-scale extortion.