Wizard Spider

{
  "id": "ATTACK:ics:G0102",
  "title": "Wizard Spider",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0102",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
  "external_id": "G0102",
  "domain": "ics",
  "created": "2020-05-12T18:15:29.396Z",
  "modified": "2026-07-31T20:48:49.730Z",
  "version": "4.1",
  "aliases": [
    "Wizard Spider",
    "UNC1878",
    "TEMP.MixMaster",
    "Grim Spider",
    "FIN12",
    "GOLD BLACKBURN",
    "ITG23",
    "Periwinkle Tempest",
    "DEV-0193",
    "Pistachio Tempest",
    "DEV-0237"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Grim Spider"
    },
    {
      "source_name": "UNC1878"
    },
    {
      "source_name": "TEMP.MixMaster"
    },
    {
      "source_name": "ITG23"
    },
    {
      "source_name": "FIN12"
    },
    {
      "source_name": "Periwinkle Tempest"
    },
    {
      "source_name": "DEV-0193"
    },
    {
      "source_name": "Pistachio Tempest"
    },
    {
      "source_name": "DEV-0237"
    },
    {
      "source_name": "GOLD BLACKBURN"
    },
    {
      "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
      "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
    },
    {
      "source_name": "FireEye Ryuk and Trickbot January 2019",
      "url": "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
    },
    {
      "source_name": "CrowdStrike Ryuk January 2019",
      "url": "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"
    },
    {
      "source_name": "CrowdStrike Grim Spider May 2019",
      "url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
    },
    {
      "source_name": "FireEye KEGTAP SINGLEMALT October 2020",
      "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft_PistachioTempest_Jan2024",
      "url": "https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest"
    },
    {
      "source_name": "CrowdStrike Wizard Spider October 2020",
      "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
    },
    {
      "source_name": "Secureworks Gold Blackburn Mar 2022",
      "url": "https://www.secureworks.com/research/threat-profiles/gold-blackburn"
    },
    {
      "source_name": "Mandiant FIN12 Oct 2021",
      "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
    },
    {
      "source_name": "IBM X-Force ITG23 Oct 2021",
      "url": "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/"
    }
  ]
}