D
CyberRussia

Wizard Spider

Cybercriminal groupTrackedPending verification

Also known as: UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237

CyberRUS
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsUNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237
ProliferationOrigin country only
Active since2016At least 2016Med[1]
MITRE ATT&CK IDG0102High[1]
Capabilities
ATT&CK techniques used64ATT&CK v20.1High[1]
Malware and toolsAdFind, Anchor, Bazar, BITSAdmin, BloodHound, Cobalt Strike, Conti, Diavol, Dyre, Emotet, Empire, GrimAgent, LaZagne, Mimikatz, Net, Nltest, Ping, PsExec, Rubeus, Ryuk and 2 more22 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorRussia-based, financially motivatedMed[1]
Notes
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Russia
Sources
  1. Wizard Spider, Group G0102, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0102)