Wizard Spider
IntrusionSet · ATTACK:enterprise:G0102
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0102",
"title": "Wizard Spider",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0102",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
"external_id": "G0102",
"domain": "enterprise",
"created": "2020-05-12T18:15:29.396Z",
"modified": "2026-07-31T20:48:49.730Z",
"version": "4.1",
"aliases": [
"Wizard Spider",
"UNC1878",
"TEMP.MixMaster",
"Grim Spider",
"FIN12",
"GOLD BLACKBURN",
"ITG23",
"Periwinkle Tempest",
"DEV-0193",
"Pistachio Tempest",
"DEV-0237"
],
"tactics": [
],
"source_references": [
{
"source_name": "Grim Spider"
},
{
"source_name": "UNC1878"
},
{
"source_name": "TEMP.MixMaster"
},
{
"source_name": "ITG23"
},
{
"source_name": "FIN12"
},
{
"source_name": "Periwinkle Tempest"
},
{
"source_name": "DEV-0193"
},
{
"source_name": "Pistachio Tempest"
},
{
"source_name": "DEV-0237"
},
{
"source_name": "GOLD BLACKBURN"
},
{
"source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
},
{
"source_name": "FireEye Ryuk and Trickbot January 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
},
{
"source_name": "CrowdStrike Ryuk January 2019",
"url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
},
{
"source_name": "CrowdStrike Grim Spider May 2019",
"url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
},
{
"source_name": "FireEye KEGTAP SINGLEMALT October 2020",
"url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft_PistachioTempest_Jan2024",
"url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
},
{
"source_name": "Secureworks Gold Blackburn Mar 2022",
"url": "https://www.secureworks.com/research/threat-profiles/gold-blackburn"
},
{
"source_name": "Mandiant FIN12 Oct 2021",
"url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
},
{
"source_name": "IBM X-Force ITG23 Oct 2021",
"url": "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/"
}
]
}Explicit source assertions (86)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0038b0b8-f51c-4fd1-8b04-2fd7ebd1d61d
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1588.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00a88d6f-fa8c-48bf-a028-fb75ca04e000
Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0266
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e03773-7cea-4b40-bf96-f22ccbc7187f
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14f3eebf-40c3-48d5-ad62-356d57ccf2dc
FireEye KEGTAP SINGLEMALT October 2020 · DFIR Ryuk's Return October 2020 · DFIR Ryuk in 5 Hours October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18437772-ace9-4a63-b928-8f313dc44f1e
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca344f1-97fe-453c-9f12-86130ddcebbc
Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dd1bd5b-8639-48bd-81bd-c34c61fd464a
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1deb3a34-8b7d-449d-8213-81a73fd9d642
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fa97951-8eba-4771-bc42-8084967f0c65
Red Canary Hospital Thwarted Ryuk October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S9001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2209dcd4-debf-44f3-91f1-be904454e629
Microsoft Ransomware as a Service · Microsoft_PistachioTempest_Jan2024ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--260a6771-1b29-49b6-ad42-6c43e68b11dc
FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b5965fe-b178-4c03-91af-942491c79302
CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bb3c950-2099-4d7d-ac13-05a1470fc3c6
DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c54816e-5dd1-4723-99f5-29c80a2fc171
CrowdStrike Grim Spider May 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dd33387-a109-46cd-8204-cb79a62e4830
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a5b04dd-815c-4f52-be7a-e997625c18e6
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0521
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b3c27ed-0129-48bf-8c79-e86d73e5b212
DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4340d15d-5577-4b4e-8e5b-570b9ab3a147
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43b9a1b5-6f95-4c6c-8e1f-59f9049e3afb
DFIR Ryuk's Return October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · DFIR Ryuk in 5 Hours October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43fabcba-66b6-45dc-b905-926f0a0a2bba
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1550.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43fec1ed-cc26-4036-95c0-1598150f3916
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bac5bdb-493b-4c32-882d-ce77786d12c9
Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0e6809-943f-424b-b8e9-f3b8baa11411
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e3b7cf3-298e-4db2-a920-375abd50280d
Sophos New Ryuk Attack October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f243ab6-812f-4fd3-9607-8d94409a94c1
CrowdStrike Grim Spider May 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53e1bf2f-7ab4-4173-879b-9975618c4527
CrowdStrike Grim Spider May 2019 · CrowdStrike Wizard Spider October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57f8c6d0-406d-4e97-b3ff-5b2f0274231b
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0359
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--585842e6-fe9a-4508-8e67-c232f8aa5e76
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a2c4561-48e4-4d51-8f00-ff470a18df32
FireEye Ryuk and Trickbot January 2019 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c252868-1474-4fed-b3b2-07a6d3415034
CrowdStrike Grim Spider May 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1552.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c98e0bb-7451-4c61-a798-4306b89b1e61
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0632
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d7d90a4-1ea6-4eca-94bd-3461d9a54229
Group IB GrimAgent July 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fe0a46c-7a06-4aea-9768-d611d3f3116d
DFIR Ryuk's Return October 2020 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0024
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61805115-3044-4ed7-91f4-074b2a073e02
Forbes Dyre May 2017 · CrowdStrike Wizard Spider March 2019 · Malwarebytes TrickBot Sep 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61a16f5b-29c2-4d75-bf4f-36228fe68016
DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61c802ec-b415-4161-bf15-3a8c5cc0a243
DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0446
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6895e54e-3968-41a9-9013-a082cd46fa44
Red Canary Hospital Thwarted Ryuk October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Ryuk January 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6924c49b-0f86-4712-9600-f91b21fa5691
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b30ddb-137c-4799-bacd-ab17aa2d01fc
DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73baa214-fbe6-477e-9beb-d1a08a6d117f
Red Canary Hospital Thwarted Ryuk October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--743f2f00-57d0-4df8-94db-b044e2551890
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75f0ea4c-5b88-4b14-9859-67379f4ba9b0
CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--773fc200-e44d-4049-b972-043c1e3d9035
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79b0a6bc-4061-468c-ac1b-eef3dc3fb419
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79e8a269-8ef5-4795-94ce-72bfbb03c7cb
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0575
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a38509d-5468-4b8f-831e-a4233a36a845
Microsoft Ransomware as a Service · CrowdStrike Wizard Spider October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e555910-0e1b-403d-a369-e7a2e8e61670
CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0367
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8263754e-20a6-49ac-9ffb-3f0e9113b228
CrowdStrike Grim Spider May 2019 · Sophos New Ryuk Attack October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82dee5a5-7890-4bed-bc8c-83ffa13a8bcf
Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1518.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87d7a5b5-8f45-4a88-bc3c-f73f67a50255
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93cd9a2c-48e3-4a95-90fb-6436afcfa7a8
CrowdStrike Grim Spider May 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9438f268-3827-435b-98b5-79dbc0ee5213
DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--970860bd-6183-4728-8f34-a5a1ad199655
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97a62430-6a83-4ead-b8c7-ce47f5d0cac0
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1557.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bd4212c-2e17-41e2-9ff3-1448642ce958
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a137a1d7-d40b-4565-8377-98a3065d5fec
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1e10048-626c-4e64-9bdb-fd576be8c19f
FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a25300cb-c2b7-4968-b1d7-cc4d5fe5bb4b
Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a28b6a04-5562-4550-91bd-6397c0c9fe3f
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aca710ff-23a3-4c78-b75a-dfe6cad337a9
Sophos New Ryuk Attack October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad06b85a-a0df-41aa-8f45-f41504987918
CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afa1618c-6a9b-49a4-8105-5cae16b3415f
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9dcab92-6b0d-43c7-a122-90eccb016b9d
DHS/CISA Ransomware Targeting Healthcare October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfd2f3f1-3a5f-4500-be4e-39e3f8d6cb8e
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c118e50b-4559-4bff-bde5-78aa426f3db4
FireEye KEGTAP SINGLEMALT October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0504
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1dc4089-a24e-44d2-84e3-47cb14964719
Microsoft Ransomware as a ServiceATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c51d9123-7f7e-41e6-8cf7-7c7dc4170ca0
CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c671056c-f213-4084-9e9e-3361274ceb80
Red Canary Hospital Thwarted Ryuk October 2020 · CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c96e7dda-d05c-458a-8332-9e7851bb4775
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd283aa1-23f1-4516-9198-9d565bd4a431
DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0659
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf32eab2-753c-4303-9667-54bc8c987a13
Microsoft Ransomware as a ServiceATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d64f970a-8003-41bf-9769-d849c12340ed
Red Canary Hospital Thwarted Ryuk October 2020 · CrowdStrike Ryuk January 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0363
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d73c0fd6-cbd9-4eaa-abca-a1626364ab1b
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d87925c8-23ed-4913-81d6-c4d93d65c798
DHS/CISA Ransomware Targeting Healthcare October 2020 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df13cae2-4e20-4e89-ae60-6bd8b99e2342
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e199c02e-a45c-4eca-ab24-7b037167c775
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e24411cf-6274-4b6b-87b4-b90b01146c8d
Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1555.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8e8e281-398c-4cec-bcc5-d12d28bada31
Mandiant FIN12 Oct 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eaebb080-e57e-4c06-84df-376cc8bff09e
DHS/CISA Ransomware Targeting Healthcare October 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3b210e4-9784-4305-8cad-6bdb4d44250f
Mandiant FIN12 Oct 2021 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020