WIZARD SPIDERThreat actor
- dev-0193
- dev-0237
- fin12
- gold blackburn
- gold ulrick
- grim spider
- itg23
- periwinkle tempest
- pistachio tempest
- storm-0193
- storm-0230
- temp.mixmaster
- trickbot llc
- unc1878
- unc2053
Wizard Spider is reportedly associated with Grim Spider and Lunar Spider. The WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPIDER appears to be a subset.From MISP Galaxy
Last reported 30 days ago, by Security Affairs3 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“… we have shown throughout the article, to execute payloads GrimAgent uses both the ShellExecute call and indirect execution through scheduled tasks.”
- T1027.007Dynamic API Resolution
“Besides, the first stage employs common techniques such API hammering and dynamic API resolution.”
- T1110Brute Force
“To improve the grasp of OysterLoader server communication we develop a Python script that brute force the shifting value to decode the message.”
- T1552.004Private Keys
“Generated client RSA public and private keys: Both stored at the config file.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Ryuk Member Karen Vardanyan Sentenced to Two Years in U.S. Prison“Ryuk RaaS was run by the crew known as Wizard Spider, which became one of the defining threats of the early pandemic years, hitting hospitals hard while healthcare systems were already stretched to breaking.”
-
OysterLoader Unmasked: The Multi-Stage Evasion Loader“According to Expel reports, OysterLoader is used by the Rhysida ransomware group which is closely associated with the WIZARD SPIDER nebula.”
-
The Brothers Grim“Later on, it was attributed to two threat actors, FIN6 and Wizard Spider.”
Indicators in its reports
named in the reports above- pefile[.]pein 1 report
- exp[.]namein 1 report
- 85.239.53[.]66in 1 report
- 51.222.96[.]108in 1 report
- 135.125.241[.]45in 1 report
- hxxps://grandideapay[.]com/api/v2/facadein 1 report
- grandideapay[.]comin 1 report
- hxxp://nucleusgate[.]com/api/v2/facadein 1 report
- nucleusgate[.]comin 1 report
- hxxps://cardlowestgroup[.]com/api/v2/facadein 1 report
- cardlowestgroup[.]comin 1 report
- hxxps://socialcloudguru[.]com/api/v2/facadein 1 report
- socialcloudguru[.]comin 1 report
- hxxps://coretether[.]com/api/v2/facadein 1 report
- coretether[.]comin 1 report
- hxxps://registrywave[.]com/api/v2/facadein 1 report
- registrywave[.]comin 1 report
- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.