Search threats, CVEs… ⌘K
← Back to all threat actors

Wizard Spider

Also known as UNC1878, TEMP.MixMaster, Grim Spider, FIN12, GOLD BLACKBURN, ITG23, Periwinkle Tempest, DEV-0193, Pistachio Tempest, DEV-0237
Tracked as G0102

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.

How we source and review actor profiles
Motivation
ransomware
Sectors
financial-services, healthcare, manufacturing
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
IdentityAlias: UNC1878

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: TEMP.MixMaster

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Grim Spider

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: FIN12

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: GOLD BLACKBURN

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: ITG23

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Periwinkle Tempest

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: DEV-0193

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Pistachio Tempest

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: DEV-0237

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G0102

Reviewed identity mapping approved on this date.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

Wizard SpiderCanonical Name
DEV-0193Alias
DEV-0237Alias
FIN12Alias
GOLD BLACKBURNAlias
Grim SpiderAlias
ITG23Alias
Periwinkle TempestAlias
Pistachio TempestAlias
TEMP.MixMasterAlias
UNC1878Alias
G0102Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...