[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFov3bCiEfA2pO0O4d6OpzzWLwaVA-ZGM9mJv-tX3YL8":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":19,"country":20,"suspected_sponsor":21,"target_industries":22,"target_countries":28,"incident_types":47,"references":48,"techniques":65,"technique_count":66,"created_at":67,"seoMetadata":68,"schemaOrg":72},"WIZARD SPIDER","wizard-spider",[9,10,11,12,13,14,15,16,17,18],"TEMP.MixMaster","GOLD BLACKBURN","FIN12","Periwinkle Tempest","DEV-0193","Storm-0193","Trickbot LLC","UNC2053","Pistachio Tempest","DEV-0237","Wizard Spider is reportedly associated with Grim Spider and Lunar Spider.\nThe WIZARD SPIDER threat group is the Russia-based operator of the TrickBot banking malware. This group represents a growing criminal enterprise of which GRIM SPIDER appears to be a subset. The LUNAR SPIDER threat group is the Eastern European-based operator and developer of the commodity banking malware called BokBot (aka IcedID), which was first observed in April 2017. The BokBot malware provides LUNAR SPIDER affiliates with a variety of capabilities to enable credential theft and wire fraud, through the use of webinjects and a malware distribution function.\nGRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past.","RU","Russian Federation",[23,24,25,26,27],"Defense","Financial","Government","Healthcare","Telecommunications",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"Australia","Bahamas","Canada","Costa Rica","France","Germany","India","Ireland","Italy","Japan","Mexico","New Zealand","Spain","Switzerland","Taiwan","United Kingdom","Ukraine","United States",[],[49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64],"https:\u002F\u002Flabs.sentinelone.com\u002Ftop-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets\u002F","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware\u002F","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fsin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web\u002F","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fwizard-spider-lunar-spider-shared-proxy-module\u002F","https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fwizard-spider-adds-new-feature-to-ryuk-ransomware\u002F","https:\u002F\u002Fwww.cybereason.com\u002Fblog\u002Fdropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware","https:\u002F\u002Fwww.fireeye.com\u002Fblog\u002Fthreat-research\u002F2019\u002F01\u002Fa-nasty-trick-from-credential-theft-malware-to-business-disruption.html","https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fgold-ulrick","https:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fdyre-banking-trojan","https:\u002F\u002Fwww.secureworks.com\u002Fblog\u002Fhow-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic","https:\u002F\u002Fwww.secureworks.com\u002Fblog\u002Ftrickbot-modifications-target-us-mobile-users","http:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fgold-blackburn","https:\u002F\u002Fstrapi.eurepoc.eu\u002Fuploads\u002FEu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf","https:\u002F\u002Fwww.prodaft.com\u002Fm\u002Freports\u002FWizardSpider_TLPWHITE_v.1.4.pdf","https:\u002F\u002Fsecurityintelligence.com\u002Fposts\u002Fitg23-crypters-cooperation-between-cybercriminal-groups\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2022\u002F05\u002F09\u002Fransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself\u002F",[],0,"2023-08-09T17:25:09.409843+00:00",{"title":69,"metaDescription":70,"keywords":71},"WIZARD SPIDER Threat Actor Profile | Precursor Intelligence","Wizard Spider is reportedly associated with Grim Spider and Lunar Spider.\nThe WIZARD SPIDER threat group is the Russia-based operator of the TrickBot ...","WIZARD SPIDER, TEMP.MixMaster, GOLD BLACKBURN, FIN12, Periwinkle Tempest, DEV-0193, Storm-0193, Trickbot LLC, UNC2053, Pistachio Tempest, DEV-0237, threat actor, APT, cyber threat, threat intelligence, Defense, Financial, Government, Russian Federation, RU",{"@context":73,"@type":74,"name":6,"alternateName":75,"description":19,"url":76,"mainEntityOfPage":77,"location":79},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fwizard-spider",{"@type":78,"@id":76},"WebPage",{"@type":80,"name":20},"Country"]