Researchers from cyber-intelligence company PRODAFT released a report detailing the inner workings of the cybercriminal group Wizard Spider. Wizard Spider (aka. TEMP.MixMaster, GOLD BLACKBURN, FIN12) is the Russian-based operator of the TrickBot banking malware. Following the discontinuation of the TrickBot malware, the operators started working closely with the Conti ransomware gang. In the report, PRODAFT mentions Wizard Spider is uniquely “capable of monetizing multiple aspects of its operations.” Typical attacks consist of the group utilizing spam campaigns to distribute malware, such as Qakbot and SystemBC. That malware is used to launch additional tools, such as Cobalt Strike (for lateral movement), and ransomware once all actions have been completed. Wizard Spider has also developed an advanced exploit toolkit allowing them to easily utilize vulnerabilities such as Log4Shell to gain access to networks. In addition, the group has built a “cracking station,” which it uses to crack the hashes of domain credentials, Kerberos tickets, KeePass password manager files, and other hashed data. If a company does not respond to ransom demands, operators cold-call victims using a VoIP setup to pressure them into paying. The group has amassed a large number of compromised devices that allow them to send spam and scan for potentially vulnerable systems to add to their botnet. The leaders of Wizard Spider have the operational skills to manage all of these workflows, employees, and compromised devices and are considered one of the most powerful APT groups active today.