Procedure examples

Wizard Spider has used Digicert code-signing certificates for some of its malware.

Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network.

Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

Wizard Spider has archived data into ZIP files on compromised machines.

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.

Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.

Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.

Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.

Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.