{
  "id": "wizard-spider",
  "name": "Wizard Spider",
  "aliases": [
    "UNC1878",
    "TEMP.MixMaster",
    "Grim Spider",
    "FIN12",
    "GOLD BLACKBURN",
    "ITG23",
    "Periwinkle Tempest",
    "DEV-0193",
    "Pistachio Tempest",
    "DEV-0237"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russia-based, financially motivated",
      "src": [
        "mitre-g0102"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2016,
      "src": [
        "mitre-g0102"
      ],
      "conf": "medium",
      "note": "At least 2016"
    },
    {
      "k": "attack_id",
      "v": "G0102",
      "src": [
        "mitre-g0102"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 64,
      "src": [
        "mitre-g0102"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AdFind, Anchor, Bazar, BITSAdmin, BloodHound, Cobalt Strike, Conti, Diavol, Dyre, Emotet, Empire, GrimAgent, LaZagne, Mimikatz, Net, Nltest, Ping, PsExec, Rubeus, Ryuk and 2 more",
      "src": [
        "mitre-g0102"
      ],
      "conf": "high",
      "note": "22 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0102)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/wizard-spider.html",
  "sources": {
    "mitre-g0102": {
      "title": "Wizard Spider, Group G0102",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0102/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}