Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-02 10:43:21 UTC Home > List all groups > Wizard Spider, Gold Blackburn APT group: Wizard Spider, Gold Blackburn Names Wizard Spider (CrowdStrike) Grim Spider (CrowdStrike) TEMP.MixMaster (FireEye) Gold Blackburn (SecureWorks) Gold Ulrick (SecureWorks) ITG23 (IBM) DEV-0193 (Microsoft) Storm-0230 (Microsoft) Periwinkle Tempest (Microsoft) G0102 (MITRE) Country Russia Motivation Financial crime, Financial gain First seen 2014 Description Wizard Spider is reportedly associated with Lunar Spider. (Crowdstrike) The Wizard Spider threat group is the Russia-based operator of the TrickBot banking malware. This represents a growing criminal enterprise of which Grim Spider appears to be a subset. The Lunar Spider threat gro Eastern European-based operator and developer of the commodity banking malware called BokBot (aka IcedID), first observed in April 2017. The BokBot malware provides Lunar Spider affiliates with a variety of capabilities to credential theft and wire fraud, through the use of webinjects and a malware distribution function. Dyre has been observed to be distributed by Cutwail (operated by Narwhal Spider), as well as their own botnets G Upatre. TrickBot has been observed to be distributed via Emotet (operated by Mummy Spider, TA542), BokBot (operated Spider), Smoke Loader (operated by Smoky Spider), DanaBot (operated by Scully Spider, TA547), Kelihos (opera Zombie Spider), Necurs (operated by Monty Spider) and Taurus Loader (operated by Venom Spider, Golden Chic well as their own botnet Gophe. Observed Sectors: Defense, Financial, Government, Healthcare, Telecommunications. Countries: Worldwide. Tools used AdFind, Anchor, BazarBackdoor, BloodHound, Cobalt Strike, Conti, Diavol, Dyre, Gophe, Invoke-SMBAutoBrut LaZagne, LightBot, PowerSploit, PowerTrick, PsExec, Ryuk, SessionGopher, TrickBot, TrickMo, Upatre. Operations performed Apr 2019 Cybercriminals Spoof Major Accounting and Payroll Firms in Tax Season Malware Campaigns Jun 2019 During June and July, F5 researchers first noticed Trickbot campaigns aimed at a smaller set of geog oriented targets and did not use redirection attacks—a divergence from previous Trickbot characteri Aug 2019 In a recent analysis in our cybercrime research labs, we noticed changes in the deployment of the Tr Trojan. At the time, the change we observed only applied to infection attempts on Windows 10 64-b operating systems (OSs). In those cases, TrickBot ran the payload, but did not save its typical modul configurations to disk. Oct 2019 Computers at the DCH Regional Medical Center in Tuscaloosa, Fayette Medical Center and Northp Medical Center were infected with ransomware. Oct 2019 Shipping giant Pitney Bowes hit by ransomware Nov 2019 Louisiana was hit by Ryuk, triggering another cyber-emergency Dec 2019 TrickBot Widens Infection Campaigns in Japan Ahead of Holiday Season Dec 2019 The Deadly Planeswalker: How The TrickBot Group United High-Tech Crimeware & APT Dec 2019 The cyberattack that took down public-access computers at Volusia County, Fla., libraries last month ransomware that has elicited millions of dollars in ransom payments from governments and large bu Dec 2019 An infection with the Ryuk ransomware took down a maritime facility for more than 30 hours; the U Guard said in a security bulletin it published before Christmas. Jan 2020 On the heels of a Ryuk ransomware attack on the Tampa Bay Times, researchers reported a new vari Ryuk stealer being aimed at government, financial and law enforcement targets. Jan 2020 Electronic Warfare Associates (EWA), a 40-year-old electronics company and a well-known US gov contractor, has suffered a ransomware infection, ZDNet has learned. Jan 2020 Top-Tier Russian Organized Cybercrime Group Unveils Fileless Stealthy “PowerTrick” Backdoor fo Value Targets Feb 2020 Ryuk Ransomware Campaign Targets Port Lavaca City Hall Feb 2020 EMCOR Group, a US-based Fortune 500 company specialized in engineering and industrial constru services, disclosed last month a ransomware incident that took down some of its IT systems. https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 2 of 8 Feb 2020 Epiq Global, an international e-discovery and managed services company, has taken its systems offl globally after detecting unauthorized activity. Mar 2020 Trickbot campaign targets Coronavirus fears in Italy Mar 2020 EVRAZ, one of the world's largest steel manufacturers and mining operations, has been hit by ranso source inside the company told ZDNet today. Mar 2020 The City of Durham, North Carolina has shut down its network after suffering a cyberattack by the R Ransomware this weekend. Mar 2020 New Variant of TrickBot Being Spread by Word Document Mar 2020 New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in Hong Kong Mar 2020 TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany Apr 2020 TrickBot Campaigns Targeting Users via Department of Labor FMLA Spam Apr 2020 As early as April 2020, TrickBot updated one of its propagation modules known as “mworm” to a n module called “nworm.” Infections caused through nworm leave no artifacts on an infected DC, and disappear after a reboot or shutdown. Jul 2020 The infamous TrickBot trojan has started to check the screen resolutions of victims to detect whethe malware is running in a virtual machine. Jul 2020 Leading toy maker Mattel hit by ransomware Aug 2020 University of Utah pays $457,000 to ransomware gang Aug 2020 Conti (Ryuk) joins the ranks of ransomware gangs operating data leak sites Sep 2020 US Court Hit by “Conti” Ransomware Sep 2020 Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider, has repor down systems at healthcare facilities around the US after a cyber-attack that hit its network during e Sunday morning. Oct 2020 French IT giant Sopra Steria hit by Ryuk ransomware Nov 2020 Online education giant K12 Inc. has paid a ransom after their systems were hit by Ryuk ransomware middle of November. Jan 2021 FatFace sends controversial data breach email after ransomware attack Jan 2021 Scottish Environment Protection Agency refuses to pay ransomware crooks over 1.2GB of stolen da Mar 2021 Ryuk ransomware hits 700 Spanish government labor agency offices Mar 2021 Ransomware gang wanted $40 million in Florida schools cyberattack Apr 2021 BazarLoader deploys a pair of novel spam vectors May 2021 Green Energy Company Volue Hit by Ransomware May 2021 Conti ransomware also targeted Ireland's Department of Health May 2021 Ireland’s Health Services hit with $20 million ransomware demand May 2021 New Zealand hospitals infected by ransomware, cancel some surgeries https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 4 of 8 May 2021 Operation “BazaFlix” The threat actor created a robust fake movie streaming service called BravoMovies, complete with f titles as a landing page. Jun 2021 Tulsa warns of data breach after Conti ransomware leaks police citations Jun 2021 Diavol - A New Ransomware Used By Wizard Spider? Aug 2021 Conti ransomware prioritizes revenue and cyberinsurance data theft Aug 2021 Nokia subsidiary discloses data breach after Conti ransomware attack Sep 2021 JVCKenwood hit by Conti ransomware claiming theft of 1.5TB data Oct 2021 Conti gang threatens to dump victim data if ransom negotiations leak to reporters Oct 2021 Conti Ransom Gang Starts Selling Access to Victims Nov 2021 Celebrity jewelry house Graff falls victim to ransomware Nov 2021 Data breach impacts 80,000 South Australian govt employees [Frontier Software] Nov 2021 From Shathak Emails to the Conti Ransomware Dec 2021 Nordic Choice Hotels hit by Conti ransomware, no ransom demand yet Dec 2021 Conti and Karma actors attack healthcare provider at same time through ProxyShell exploits https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 5 of 8 Dec 2021 Australian Electricity Provider 'CS Energy' Hit by Ransomware Dec 2021 McMenamins breweries hit by a Conti ransomware attack Dec 2021 Shutterfly services disrupted by Conti ransomware attack Dec 2021 RR Donnelly has confirmed that threat actors stole data in a December cyberattack, confirmed by BleepingComputer to be a Conti ransomware attack. Dec 2021 Indonesia's central bank confirms ransomware attack, Conti leaks data Jan 2022 The Conti ransomware gang has been linked to an attack on Delta Electronics, a Taiwanese electron manufacturing company and a major supplier of power components to companies like Apple and Te Jan 2022 KP Snacks giant hit by Conti ransomware, deliveries disrupted Feb 2022 A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies Feb 2022 The TrickBot Saga’s Finale Has Aired: Spinoff is Already in the Works Feb 2022 Trickbot Group’s AnchorDNS Backdoor Upgrades to AnchorMail Mar 2022 Ransomware gang Conti has already bounced back from damage caused by chat leaks, experts say Mar 2022 Shutterfly discloses data breach after Conti ransomware attack Mar 2022 Ransomware Gang Leaks Files Stolen From Industrial Giant Parker Hannifin Apr 2022 The Parker-Hannifin Corporation announced a data breach exposing employees' personal informatio Conti ransomware gang began publishing allegedly stolen data last month. https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 6 of 8 Apr 2022 Wind turbine firm Nordex hit by Conti ransomware attack Apr 2022 Conti ransomware attack was aimed at destabilizing government transition, Costa Rican president sa Apr 2022 Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine May 2022 Conti ransomware claims to have hacked Peru MOF – Dirección General de Inteligencia (DIGIMIN Jun 2022 Conti ransomware group’s pulse stops, but did it fake its own death? Counter operations Nov 2015 Russia’s FSB quietly led an operation to take down the world’s most active cybercriminal groups, th operators of the banking malware Dyre Oct 2020 We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world. We have now cut off key infrastru those operating Trickbot will no longer be able to initiate new infections or activate ransomware alre dropped into computer systems. Sep 2021 Irish police seize Conti domains used in HSE ransomware attack Oct 2021 TrickBot malware dev extradited to U.S. faces 60 years in prison Feb 2022 Conti ransomware gang chats leaked by pro-Ukraine member https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 7 of 8 Mar 2022 Exposing initial access broker with ties to Conti Mar 2022 More Conti ransomware source code leaked on Twitter out of revenge May 2022 Reward Offers for Information to Bring Conti Ransomware Variant Co-Conspirators to Justice Feb 2023 Russian man pleads guilty to laundering Ryuk ransomware money Sep 2023 United States and United Kingdom Sanction Additional Members of the Russia-Based Trickbot Cyb Gang Dec 2023 TrickBot malware dev pleads guilty, faces 35 years in prison May 2025 Germany doxxes Conti ransomware and TrickBot ring leader Information MITRE ATT&CK Last change to this card: 16 August 2025 Download this actor card in PDF or JSON format Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec https://apt.etda.or.th/cgi-bin/showcard.cgi?u=480940e0-47b0-4295-9067-c2500ccfdaec Page 8 of 8