Wizard Spider

Wizard Spider, also known as Trickbot, DEV-0193, UNC2053, or Periwinkle Tempest, was a cybercrime group based in and around Saint Petersburg in Russia. Some members may be based in
Ukraine. They are estimated to number about 80, some of them may not know they are employed by a criminal organisation.

The group has been a target of Europol, Interpol, FBI and also the National Crime Agency in the United Kingdom.

History

In 2018 the groups began using Trickbot, Ryuk and Conti ransomware as their primary tools.

The group is also responsible for developing the espionage software Sidoh, which only gathers information and does not hold it to ransom. In 2020 their software infected three Minnesota medical facilities, locking staff out of computers, which required court orders to try and force the hackers out of the command and control servers.

By the start of February 2022 some internal communications from the group had been leaked.

In late February 2022, members of the group initially supported the Russian invasion of Ukraine, causing internal group communications to be leaked by an anonymous persons in support of Ukraine.

The groups servers were eventually shut down in 2022.

In February 2023 United States Secretary of State Antony Blinken announced that the United States and United Kingdom had sanctioned seven men for allegedly spreading Conti, Ryuk and Trickbot malware. Travel bans were imposed on them, their assets were seized and American and British companies and citizens are prohibited from conducting any business with them. Their names were Vitaliy Kovalev, Valery Sedletski, Valentin Karyagin, Maksim Mikhailov, Dmitry Pleshevskiy, Mikhail Iskritskiy and Ivan Vakhromeyev. Also, any foreign banks that knowingly provide significant services to those men could also be sanctioned.

In September 2023 the USA and UK sanctioned another 11 men connected to Wizard Spider. Their assets in the USA and UK are to be seized and travel bans imposed on them. Wizard Spider was lined to Russian intelligence by the American government. The men named were:

Other indictments were unsealed, including one in southern California against Maksim Galochkin, on three charges of hacking and deploying Conti on Scripps health hospitals.

As of October 2024 it was disbanded.

Modus operandi

PRODAFT wrote a technical report describing their attacks and organisation. Attacks usually begin by sending large amounts of spam to targets in order to trick victims into downloading malware. They use Qbot and SystemBC malware, as well as writing their own. A separate team pinpoints valuable targets and uses Cobalt Strike to attack them. If they gain control of the system, they deploy ransomware.

They have simultaneously transferred Bitcoin from Ryuk and Conti ransomware attacks into their own wallets, implying they are carrying out several attacks using different malware.

They are very security conscious and do not openly advertise on the darknet. They will only work with or sell access to criminals they trust. They are known to belittle their victims via a leak site. The leak site is also used to publish data they have stolen.

Intelligence agencies say that the group does not attack targets in Russia, nor do key figures travel outside the country for fear of being arrested. The Irish Times reports Wizard Spider software is programmed to uninstall itself if it detects that the system uses the Russian language or if the system has an IP address in the former Soviet Union. However, research by PRODAFT found the majority of SystemBC-infected machines to be within Russia (20.5%).

Russia is suspected of tolerating Wizard Spider and even assisting them.

Suspected attacks

They are suspected of being behind the Health Service Executive cyberattack in the Republic of Ireland. It is the largest known attack against a health service computer system.

Key figures are suspected of being involved with online attacks using Dyre software.

Associates

Members of the group have been linked to UNC1878, TEMP.MixMaster, and Grim Spider.

A research report by Jon DiMaggio suggests the group is part of a collections of criminals known as the Ransom Cartel or Maze Cartel. Other members include TWISTED SPIDER, VIKING SPIDER, LockBit gang and SunCrypt gang. All use ransomware to extort money. SunCrypt have since retired.

The PRODAFT report authors found that Wizard Spider sometimes backed up data to a server and that the server contained data from systems that had also been attacked by REvil, though the authors could not conclude which of the two groups had taken the data.

References

External links

Wizard Spider Group In-Depth Analysis
- report by PRODAFT, 16 May 2022
{{Hacking in the 2020s

Cyberattack gangs
Hacking in the 2010s
Hacking in the 2020s
Russian advanced persistent threat groups
Criminal advanced persistent threat groups