Wizard SpiderG0102 state

About this actor

GRIM SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER, a criminal enterprise of which GRIM SPIDER appears to be a cell. The WIZARD SPIDER threat group, known as the Russia-based operator of the TrickBot banking malware, had focused primarily on wire fraud in the past. Similar to Samas and BitPaymer, Ryuk is specifically used to target enterprise environments. Code comparison between versions of Ryuk and Hermes ransomware indicates that Ryuk was derived from the Hermes source code and has been under steady development since its release. Hermes is commodity ransomware that has been observed for sale on forums and used by multiple threat actors. However, Ryuk is only used by GRIM SPIDER and, unlike Hermes, Ryuk has only been used to target enterprise environments. Since Ryuk’s appearance in August, the threat actors operating it have netted over 705.80 BTC across 52 transactions for a total current value of $3,701,893.98 USD. Grim Spider is reportedly associated with Lunar Spider and Wizard Spider.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

How we know this

See how actor data is built for the full pipeline.

Activity timeline

• 2026 — 1 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• Ajax Security Team 1 shared CVEs
• APT29 1 shared CVEs
• APT38 1 shared CVEs
• Sandworm Team 1 shared CVEs
• Tonto Team 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs
• Scattered Spider 1 shared CVEs
• OilRig 1 shared CVEs
• Indrik Spider 1 shared CVEs
• Mustang Panda 1 shared CVEs

Similar actors