{
	"id": "ec964281-0981-4f31-9be5-cbe4fe14cff3",
	"created_at": "2026-04-06T01:29:18.011933Z",
	"updated_at": "2026-04-10T03:24:29.704447Z",
	"deleted_at": null,
	"sha1_hash": "6974025b7631572e4e3d29c5a300f29addd61c60",
	"title": "Inside Trickbot, Russia’s Notorious Ransomware Gang",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1299395,
	"plain_text": "Inside Trickbot, Russia’s Notorious Ransomware Gang\r\nBy Matt Burgess\r\nPublished: 2022-02-01 · Archived: 2026-04-06 00:57:49 UTC\r\nFeb 1, 2022 7:00 AM\r\nInternal messages WIRED has viewed shed new light on the operators of one of the world's biggest botnets.\r\nPhotograph: katleho Seisa/Getty Images\r\nWhen the phones and computer networks went down at Ridgeview Medical Center’s three hospitals on October\r\n24, 2020, the medical group resorted to a Facebook post to warn its patients about the disruption. One local\r\nvolunteer-run fire department said ambulances were being diverted to other hospitals; officials reported patients\r\nand staff were safe. The downtime at the Minnesota medical facilities was no technical glitch; reports quickly\r\nlinked the activity to one of Russia’s most notorious ransomware gangs.\r\nYou’ve read your last free article.\r\nhttps://www.wired.com/story/trickbot-malware-group-internal-messages/\r\nPage 1 of 3\n\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters—cancel anytime.\r\nSTART FREE TRIAL\r\nAlready a subscriber? Sign In\r\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters START FREE TRIAL\r\nhttps://www.wired.com/story/trickbot-malware-group-internal-messages/\r\nPage 2 of 3\n\nMatt Burgess is a senior writer at WIRED focused on information security, privacy, and data regulation in Europe.\r\nHe graduated from the University of Sheffield with a degree in journalism and now lives in London. Send tips to\r\nMatt_Burgess@wired.com. ... Read More\r\nDon't Just Keep Up. Get Ahead\r\nSign up for the Daily newsletter to get our biggest stories, handpicked for you each day.\r\nRead More\r\nSource: https://www.wired.com/story/trickbot-malware-group-internal-messages/\r\nhttps://www.wired.com/story/trickbot-malware-group-internal-messages/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.wired.com/story/trickbot-malware-group-internal-messages/"
	],
	"report_names": [
		"trickbot-malware-group-internal-messages"
	],
	"threat_actors": [
		{
			"id": "aa73cd6a-868c-4ae4-a5b2-7cb2c5ad1e9d",
			"created_at": "2022-10-25T16:07:24.139848Z",
			"updated_at": "2026-04-10T02:00:04.878798Z",
			"deleted_at": null,
			"main_name": "Safe",
			"aliases": [],
			"source_name": "ETDA:Safe",
			"tools": [
				"DebugView",
				"LZ77",
				"OpenDoc",
				"SafeDisk",
				"TypeConfig",
				"UPXShell",
				"UsbDoc",
				"UsbExe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775438958,
	"ts_updated_at": 1775791469,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6974025b7631572e4e3d29c5a300f29addd61c60.pdf",
		"text": "https://archive.orkl.eu/6974025b7631572e4e3d29c5a300f29addd61c60.txt",
		"img": "https://archive.orkl.eu/6974025b7631572e4e3d29c5a300f29addd61c60.jpg"
	}
}