Wizard Spider
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 107 incidents
- Sources
- 80 sources
- First seen
- 2019-04-26
- Last seen
- 2023-05-05
- Updated
- 2026-10-13 06:27
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Wizard Spider, also known as Conti, is a Russian-linked ransomware group operating as a ransomware‑as‑a‑service that has targeted sectors including government, energy, healthcare, aviation security, and manufacturing across regions such as Europe, North America, and Latin America. Its operations are financially motivated, using ransomware encryption coupled with threats to leak stolen data (double extortion) to extort payments, and have also been described as aiming to destabilize governmental transitions. Initial access is commonly gained via phishing emails delivering TrickBot or BazarLoader, exploitation of vulnerabilities such as CVE‑2020‑0796, and post‑exploitation tools like BloodHound, Mimikatz, and Cobalt Strike to escalate privileges and move laterally. The group maintains leak sites for data publication and has been affiliated with the broader Wizard Spider cybercrime network, which is also associated with Ryuk and TrickBot malware. Notable campaigns include the 2022 ransomware assault on Costa Rican government agencies that prompted a national emergency, the 2022 attack on Peru’s Dirección General de Inteligencia, and the 2023 ransomware incident affecting Norway‑based green energy provider Volue.
Incidents
Attributed incidents are available to members.
107 incidentsSources
Sources available to members: 80 sources.