WIZARD SPIDER
Wizard Spider is a financially motivated cybercriminal threat actor associated in the provided content with TrickBot and later Conti-related operations. Known aliases in the content include Conti Team 1, DEV-0193, DEV-0237, FIN12, G0102, GOLD BLACKBURN, GOLD ULRICK, Grim Spider, ITG23, Periwinkle Tempest, Pistachio Tempest, Storm-0230, TEMP.MixMaster, TrickBot Gang, UNC1878, and UNC2053. The content also notes overlap between GOLD ULRICK as the operator of Conti ransomware and GOLD BLACKBURN as the operator of TrickBot, and states that Conti appeared to merge with TrickBot, aka Wizard Spider, by the end of 2021. FIN12 is described as a financially motivated group active since at least October 2018 that specializes in post-compromise deployment of Ryuk ransomware. The actor is linked in the content to TrickBot, Ryuk, Conti, Bazar, Emotet, and Bokbot delivery or deployment chains. The content states that Wizard Spider installed TrickBot as a Windows service named ControlServiceA for persistence, used spearphishing attachments containing macros to lure victims into downloading Emotet, Bokbot, TrickBot, or Bazar, and used PowerShell for command execution. It is also associated with HTTP network communications. Post-compromise behavior directly attributed in the content includes use of whoami to identify the local user and privileges; ipconfig to identify victim network configuration; PowerShell Get-ADComputer to collect IP address data and account names from Active Directory; and net group "Domain admins" /DOMAIN to identify domain administrators. The content also states that Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies, and has used Conti ransomware to automatically delete volume shadow copies with vssadmin. Additional ATT&CK-related annotations in the content associate Wizard Spider with PowerShell execution, remote services, impair defenses, exploitation for privilege escalation, and Windows service persistence/installation. The content further references a possible infrastructure link to an ex-Conti sysadmin and former Conti technical lead known as Bentley, raising a possible connection to Wizard Spider, but this is presented only as a suggested link rather than a confirmed attribution.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
36 malware families attributed to this actor across reporting.
31 additional families tracked in Mallory.
Associated vulnerabilities
17 CVEs this actor has used in observed campaigns. 17 of them exploited in the wild.
Afin de se latéraliser, les opérateurs du MOA ont tenté, sans succès, d’exploiter les vulnérabilités PrintNightmare (CVE-2021-34527), BlueKeep (CVE-2019-0708), puis ZeroLogon (CVE-2020-1472) via l’outil Mimikatz.
DEV-0193 infrastructure has also been implicated in attacks deploying novel techniques, including exploitation of CVE-2021-40444.
De plus, grâce à des liens d’infrastructure, l’ANSSI a pu rattacher au même MOA plusieurs exploitations de la vulnérabilité ProxyNotShell (CVE-2022-41080 et CVE-2022-41082) ayant mené au déploiement de Play.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as Eternal Blue, during operations.
12 more CVEs tied to this actor tracked in Mallory.
Observables
396 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as the threat actor associated with Ryuk ransomware in an example malware-to-infrastructure pivot workflow.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Referenced in annotations associated with remote services, lateral movement, and impair defenses tactics, but no specific campaign details are provided in the content.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.