Quick links
Press Enter to search, Esc to close
Threat group profile
Wizard Spider is a Russia-based criminal group behind the Trickbot malware, attributed by the US Department of Justice and Treasury, the UK government and Germany's BKA.
In short
Wizard Spider is a Russia-based criminal group behind the Trickbot malware, attributed by the US Department of Justice and Treasury, the UK government and Germany's BKA. Its work is stealing money and data and installing ransomware such as Ryuk and Conti. In 2023 the US charged nine members and the US and UK sanctioned 18 people.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Wizard Spider | MITRE ATT&CK G0102 (group name); UK government 9 Feb 2023; Rewards for Justice; BKA wanted notice[1, 5, 8] |
| Trickbot group | US Treasury 9 Feb and 7 Sep 2023; BKA wanted notice[4, 8] |
| UNC1878 | MITRE ATT&CK (Associated Groups); UK government 9 Feb 2023[1, 5] |
| GOLD BLACKBURN | MITRE ATT&CK (Associated Groups); UK government 9 Feb 2023 (as Gold Blackburn)[1, 5] |
| Grim Spider | MITRE ATT&CK (Associated Groups)[1] |
| TEMP.MixMaster | MITRE ATT&CK (Associated Groups)[1] |
| FIN12 | MITRE ATT&CK (Associated Groups)[1] |
| ITG23 | MITRE ATT&CK (Associated Groups)[1] |
| Periwinkle Tempest | MITRE ATT&CK (Associated Groups)[1] |
| DEV-0193 | MITRE ATT&CK (Associated Groups)[1] |
| Pistachio Tempest | MITRE ATT&CK (Associated Groups)[1] |
| DEV-0237 | MITRE ATT&CK (Associated Groups)[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 4.1, last modified 31 July 2026
Describes Wizard Spider as a Russia-based, financially motivated group known for creating and deploying TrickBot since at least 2016. Lists Conti, Ryuk and Diavol among its software.[1]
CISA, FBI and HHS 28 Oct 2020 (updated to 2 Nov 2020)
Joint advisory AA20-302A. Warned of an imminent ransomware threat to US hospitals and said a "cybercriminal enterprise" is behind TrickBot and likely also BazarLoader. It does not use the name Wizard Spider.[2]
CISA, FBI and NSA (US Secret Service added in 2022) 22 Sep 2021 (updated 9 Mar 2022)
Joint advisory AA21-265A on Conti. Says Conti actors sometimes use TrickBot. It does not name Wizard Spider or link Conti to one group.[3]
US Treasury 9 Feb 2023
Designated seven people as "part of the Russia-based cybercrime gang Trickbot". Says current members are associated with Russian Intelligence Services.[4]
UK government (FCDO, NCA and HM Treasury) 9 Feb 2023
Sanctioned the same seven people. Named Conti, Wizard Spider, UNC1878, Gold Blackburn, Trickman and Trickbot as ransomware groups responsible for developing and deploying Trickbot, Anchor, BazarLoader, BazarBackdoor, Conti and Diavol, and involved in deploying Ryuk.[5]
UK NCSC 9 Feb 2023
Assessed that key members of the Conti group highly likely maintain links to the Russian Intelligence Services and have likely received tasking from them.[5]
US Treasury 7 Sep 2023
Sanctioned eleven more people. Said the Trickbot group has ties to Russian intelligence services.
UK government 7 Sep 2023
Sanctioned eleven people. The NCA assesses the group extorted at least 180 million dollars globally and at least 27 million pounds from 149 UK victims. Says the group received tasking from the Russian Intelligence Services (per UK Foreign, Commonwealth and Development Office and National Crime Agency).
US Department of Justice 7 Sep 2023
Unsealed three indictments: nine Russian nationals charged over Trickbot, four of them also charged over Conti, and one of them over a Conti attack on a US health system.[6]
US Department of Justice 25 Jan 2024 (press release)
Said Vladimir Dunaev, a Trickbot developer, was sentenced to five years and four months in prison.[7]
US State Department (Rewards for Justice) Page undated
Describes "Conti (also known as Wizard Spider)" as a Russian government-linked ransomware-as-a-service group.
German Federal Criminal Police Office (BKA) Notice last updated 23 May 2025
Suspects Vitalii Kovalev of founding the "Trickbot" group, also known as "Wizard Spider". Assumes he lives in the Russian Federation.[8]
Sources differ on how Wizard Spider, Conti and Ryuk relate. MITRE lists Conti and Ryuk as software used by Wizard Spider, Rewards for Justice says "Conti (also known as Wizard Spider)", and the UK government (9 February 2023) lists Conti and Wizard Spider among the names of the ransomware groups.
The US Department of Justice charges Trickbot (nine people) and Conti (four of the same nine) in separate indictments, and CISA advisory AA21-265A describes "Conti actors" without naming Wizard Spider. On state links, Treasury and the UK government (both 2023) describe ties to Russian intelligence services and Rewards for Justice calls Conti "Russian government-linked", while MITRE, CISA and the Department of Justice press release state no such link.
Aliases also differ: Treasury (9 February 2023) gives "Bentley" to Kovalev, while Treasury (7 September 2023) and the Department of Justice give it to Galochkin.
Each entry is attributed to the group by the sources cited.
Treasury says Dyre, the banking trojan that Trickbot evolved from, began targeting non-Russian businesses and entities in mid-2014.[4]
The Ohio indictment alleges the conspiracy to use Trickbot began in November 2015.[6]
CISA, FBI and HHS say Ryuk first appeared in August 2018 and was typically deployed as a payload from banking trojans such as TrickBot.[2]
The FBI began to observe new TrickBot modules named Anchor, typically used against high-profile victims.[2]
CISA, FBI and HHS say actors believed to be associated with TrickBot began using BazarLoader and BazarBackdoor around this time.[2]
Treasury says the Trickbot Group launched ransomware attacks against hospitals across the US during the pandemic, including three Minnesota facilities.[4]
CISA, FBI and HHS warned of an imminent threat to US hospitals. Updated the next day to cover Conti, TrickBot and BazarLoader.[2]
The Department of Justice indictment in California charges Galochkin over this Conti attack.[6]
The FBI identified at least 16 Conti attacks on US healthcare and first responder networks.
CISA and the FBI reported observing Conti in more than 400 attacks and described how Conti actors get in.[3]
The BKA says the group's internal chat messages became public early in 2022 under names such as "Conti-Leaks" and "Trickbotleaks".[8]
CISA and partners re-released AA21-265A and said attacks had risen to more than 1,000.[3]
The UK government says the ransomware group responsible for Conti disbanded in May 2022.[5]
The Department of Justice says Trickbot was taken down in 2022.[6]
The Tennessee indictment alleges the Conti conspiracy ran from 2020 through June 2022.[6]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 28 June 2019 | CISA | AlertPointed to a UK NCSC advisory on Ryuk ransomware and its links to Emotet and TrickBot. |
| 28 October 2020 | CISA, FBI and HHS | Joint advisory AA20-302ADescribed ransomware, notably Ryuk and Conti, aimed at the healthcare sector, and TrickBot and BazarLoader as the loaders. Updated 29 October and 2 November 2020.[2] |
| 29 October 2020 | UK NCSC | Statement (per UK National Cyber Security Centre)Pointed to the US advisory and to its own earlier Ryuk advisory on links to Emotet and Trickbot infections. |
| 20 May 2021 | FBI | FLASH alertReported at least 16 Conti attacks on US healthcare and first responder networks. |
| 20 May 2021 | CISA and FBI | Joint advisory AA21-076ADescribed TrickBot phishing in North America and said TrickBot can drop Ryuk and Conti ransomware. Last revised on this date. |
| 22 September 2021 | CISA, FBI and NSA | Joint advisory AA21-265ADescribed Conti ransomware, its entry methods and mitigations.[3] |
| 2021 | US Department of Justice | ExtraditionTrickbot developer Vladimir Dunaev was extradited from the Republic of Korea to the Northern District of Ohio.[7] |
| 9 March 2022 | CISA, FBI, NSA and US Secret Service | Advisory re-releaseRe-released AA21-265A with new indicators of compromise.[3] |
| 9 February 2023 | US Treasury (OFAC) | SanctionsDesignated seven people said to be part of the Trickbot gang.[4] |
| 9 February 2023 | US Department of Justice | Indictment unsealedAn indictment in New Jersey charged Vitaly Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud over 2009 and 2010 intrusions.[4] |
| 9 February 2023 | UK FCDO, NCA and HM Treasury | SanctionsSanctioned the same seven people, the first sanctions of their kind for the UK.[5] |
| June 2023 | US Department of Justice | SentenceAlla Witte, a Trickbot developer and Latvian national, was sentenced to 32 months after pleading guilty.[6] |
| 7 September 2023 | US Treasury (OFAC) | SanctionsDesignated eleven more people said to be part of the Trickbot group. |
| 7 September 2023 | UK FCDO, NCA and HM Treasury | Sanctions (per UK Foreign, Commonwealth and Development Office and National Crime Agency)Sanctioned eleven people with asset freezes and travel bans. The total sanctioned by the UK was then 18. |
| 7 September 2023 | US Department of Justice | Indictments unsealedThree indictments: nine defendants over Trickbot in Ohio, four over Conti in Tennessee, one over a Conti attack on a US health system in California.[6] |
| 30 November 2023 | US Department of Justice | Guilty plea (per US Department of Justice, Northern District of Ohio)Dunaev pleaded guilty to conspiracy to commit computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud. |
| 24 January 2024 | US Department of Justice | SentenceDunaev was sentenced to five years and four months in prison.[7] |
| 23 May 2025 | German BKA | Wanted noticeNotice for Vitalii Nikolaevich Kovalev, suspected of founding the group, last updated on this date.[8] |
| Page undated | US State Department (Rewards for Justice) | Reward offerOffers up to 10 million dollars for information on a person acting for a foreign government who attacks US critical infrastructure, and names five online aliases ("Target", "Reshaev", "Professor", "Tramp", "Dandis") believed to be linked to Conti. |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
MITRE says it sends Office documents with macros or PDFs with malicious links to download Emotet, Bokbot, TrickBot or Bazar.[1, 2]
Phishing: Spearphishing Link T1566.002
Emails link to a document on Google Drive or another free file-hosting service, as MITRE and the CISA, FBI and HHS advisory describe.[1, 2]
External Remote Services T1133
MITRE says it used stolen credentials to get into corporate VPN infrastructure.[1]
Valid Accounts T1078
MITRE says it used valid privileged credentials to reach domain controllers. CISA, FBI and NSA say Conti actors have used stolen RDP credentials.[1, 3]
TrickBot Modular malware
The group's signature tool. Began as a banking trojan and now loads other malware, including ransomware.[1, 2, 4]
Anchor Backdoor
TrickBot module family used on selected high-profile targets, with a DNS-based channel to the attackers.[2]
Bazar Loader and backdoor
Used since 2020 and tied to TrickBot campaigns. Often leads to ransomware. Also called BazarLoader.[2]
Ryuk Ransomware
First appeared in August 2018. Typically deployed as a payload from banking trojans such as TrickBot.[2]
Conti Ransomware
MITRE lists it as Wizard Spider software. The UK and Rewards for Justice also use Conti as a group name.[1, 5]
Diavol Ransomware
MITRE says its ransomware-as-a-service program is managed by Wizard Spider.[1]
Emotet Loader
MITRE lists it among malware the group delivers by phishing, and describes it as a downloader for TrickBot and others.[1]
Cobalt Strike Attack framework
Named by MITRE among tools the group has used for targeting.[1]
SystemBC Malware
Listed by MITRE and named by the BKA among malware the group used.[1, 8]
IcedID Malware
Named by the BKA among malware the group used.[8]
Dyre Banking trojan
Treasury says Trickbot evolved from Dyre.[4]
Update operating systems and software promptly. MITRE names Zerologon (CVE-2020-1472) and EternalBlue, and the Conti advisory also names PrintNightmare (CVE-2021-34527).
Counters T1210
See which remote desktop, VPN and other remote access services of your company face the internet, the entry points the advisories ask you to close.
Find look-alike domains and fake sign-in or document-sharing pages aimed at your staff, since MITRE and CISA describe phishing links as an entry route.
Watch for leaked or sold company credentials, since MITRE says the group has used stolen credentials to reach VPN infrastructure.
Follow ransomware activity and leak-site posts that involve your sector or suppliers.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
MITRE describes it as a Russia-based, financially motivated group known for creating and deploying TrickBot since at least 2016. The BKA says the "Trickbot" group is also known as "Wizard Spider".
Sources differ. MITRE lists Conti and Ryuk as software it used. Rewards for Justice says "Conti (also known as Wizard Spider)". The US Department of Justice charges Trickbot and Conti in separate indictments, and CISA advisory AA21-265A on Conti does not name Wizard Spider.
Yes. The US and UK sanctioned seven people in February 2023 and eleven in September 2023. The US Department of Justice unsealed indictments against nine people on 7 September 2023. An indictment is only an allegation.
The US, UK and German governments name hospitals, emergency services, schools, local authorities, banks and companies. CISA, FBI and HHS warned in October 2020 of an imminent threat to US hospitals.
MITRE and CISA describe phishing emails with attachments or links, stolen VPN and remote desktop credentials, and known flaws such as Zerologon and EternalBlue.
Require multi-factor authentication on remote access, close unused remote desktop ports, filter phishing and macros, patch known flaws, and keep offline backups.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
