Wizard Spider
Wizard Spider is a Russia-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 16 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 83 MITRE ATT&CK techniques and exploits 68 known CVEs.
- Origin
- Russia
- Techniques
- 83
- Exploited CVEs
- 68
- Record updated
Who They Target.
About Wizard Spider.
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals. The selected public source set supports operationally dated Ryuk, Naver phishing, HSE Conti, and Conti ransomware activity through a May 2022 upper bound; `2022-05-31` is retained as an operational upper-bound `last_seen`, not an exact final intrusion timestamp.
Last updated Oct 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.