{"type":"bundle","id":"bundle--81d2ae90-5a0e-5139-b1b6-15d471b0b023","objects":[{"type":"intrusion-set","id":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Wizard Spider","description":"Wizard Spider is a financially motivated Russian cybercriminal group active since 2016, widely known for operating the TrickBot banking trojan and associated malware ecosystem including BazarBackdoor, Ryuk, and Conti ransomware. The group conducts sophisticated, multi-stage intrusions typically beginning with TrickBot or BazarBackdoor infections that facilitate lateral movement and ultimately ransomware deployment against high-value targets. Their operations span a broad range of sectors globally—including finance, government, healthcare, education, and critical infrastructure—across North America, Europe, Asia, and Latin America, with attacks driven primarily by large ransom demands and financial extortion.","aliases":["UNC1878","FIN12","Trickbot Gang","Grim Spider","TEMP.MixMaster","Periwinkle Tempest","GOLD BLACKBURN"],"first_seen":"2016-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/wizard-spider"}],"labels":["cybercrime","ran"]},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--f18b36c4-0fa0-56b6-993b-59acc4bfe9fd","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--f815664f-4f01-5aa8-ac09-26c387a47ff1","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Bangladesh","country":"BD","region":"asia"},{"type":"relationship","id":"relationship--06c3d780-eec0-58b0-8e0e-b0ad4f3f636c","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--8e036a5e-9345-54d2-9c65-292cc3413f36","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--ffb21433-ccae-5a41-9435-dfcbfe72275d","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Brunei","country":"BN","region":"asia"},{"type":"relationship","id":"relationship--73e30d7a-d627-5bc4-b417-15d6d984e542","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--ffb21433-ccae-5a41-9435-dfcbfe72275d"},{"type":"location","id":"location--c765e734-0df7-5ebd-9c36-9a00585c346d","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Bahamas","country":"BS","region":"americas"},{"type":"relationship","id":"relationship--6a9f3ffb-fad1-5e2c-9a30-975ba0354755","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--c765e734-0df7-5ebd-9c36-9a00585c346d"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--e43b4d83-e2b4-511d-8881-805f6bc40b93","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--95c7c969-bbc1-5bf9-ade6-a8cc329787dc","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--8caa88dc-eaaa-55a8-83ef-51b8491a30af","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--50201e1f-dc18-5381-8af0-a830e2a41254","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--55ec9449-2ffc-5bb4-a876-cf7722d9ed24","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Dominican Republic","country":"DO","region":"americas"},{"type":"relationship","id":"relationship--7aac1a78-8520-5ac0-b55e-8c717327d321","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--55ec9449-2ffc-5bb4-a876-cf7722d9ed24"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--86244c3c-d81d-5877-960c-da564ce17374","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--8ebd9eef-0bff-5939-9063-c6f3c7142070","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--2f4dd96f-b114-54bd-bf86-1b90adbf7603","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Honduras","country":"HN","region":"americas"},{"type":"relationship","id":"relationship--b2a412c6-406d-5d20-b1c3-d02255ae71a0","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--2f4dd96f-b114-54bd-bf86-1b90adbf7603"},{"type":"location","id":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Hungary","country":"HU","region":"europe"},{"type":"relationship","id":"relationship--5bce6ef2-2519-5945-9eef-5fa31def965a","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--3671be44-6a0d-59cb-8ab1-1f6f7236ab0b","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--f6ba58df-1d32-5f76-ae73-28532d3b72a1","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--1faaca57-40f6-50ab-bfaa-f6975424db9a","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Luxembourg","country":"LU","region":"europe"},{"type":"relationship","id":"relationship--756085a4-e5c8-53f1-af91-473d3ef530eb","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--1faaca57-40f6-50ab-bfaa-f6975424db9a"},{"type":"location","id":"location--65f9d1ed-f890-5422-9b80-26fc28964f39","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Mexico","country":"MX","region":"americas"},{"type":"relationship","id":"relationship--694128c0-2a7a-5671-8fa6-ed7f96dd2826","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--65f9d1ed-f890-5422-9b80-26fc28964f39"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--13e90d6f-1dea-5ff5-ab65-09ef2a693996","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--98563776-9dda-519c-8ef1-6dda2fda604a","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--48c0566b-263f-5cdb-b529-4f2715353a59","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Serbia","country":"RS","region":"europe"},{"type":"relationship","id":"relationship--06baab45-5990-52bd-ba32-f0c566fb77cc","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--48c0566b-263f-5cdb-b529-4f2715353a59"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--89418295-743c-5f75-ab6c-cdcdfa7491da","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Tunisia","country":"TN","region":"africa"},{"type":"relationship","id":"relationship--aaf9487f-f5ff-592d-aded-ec89890ba7c9","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--c8ae36fb-b17f-55d7-9a3a-4000d82d10fc","spec_version":"2.1","created":"2026-05-20T09:52:30.398301+00:00","modified":"2026-07-29T07:58:46.071+00:00","relationship_type":"targets","source_ref":"intrusion-set--490c933d-6d0f-5189-ae88-32e44cacd443","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"}]}