{"id":31311,"date":"2022-05-18T10:40:26","date_gmt":"2022-05-18T09:40:26","guid":{"rendered":"https:\/\/smartmileco.com\/wizard-spider-hackers-hire-cold-callers-to-scare-ransomware-victims-into-paying-up\/"},"modified":"2022-05-18T10:40:26","modified_gmt":"2022-05-18T09:40:26","slug":"wizard-spider-hackers-hire-cold-callers-to-scare-ransomware-victims-into-paying-up","status":"publish","type":"post","link":"https:\/\/smartmileco.com\/wizard-spider-hackers-hire-cold-callers-to-scare-ransomware-victims-into-paying-up\/","title":{"rendered":"Wizard Spider hackers hire cold callers to scare ransomware victims into paying up","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/p>\n

\n
\n
\n
\n

\"Charlie<\/span><\/p><\/div>\n<\/div><\/div>\n

Researchers have exposed the inner workings of Wizard Spider, a hacking group that pours its illicit proceeds back into the criminal enterprise. <\/p>\n

On Wednesday, PRODAFT published the results of an investigation<\/a> into Wizard Spider, believed to either be or be associated with the Grim Spider and Lunar Spider hacking groups.<\/p>\n

According to the cybersecurity firm, Wizard Spider<\/a>, likely Russian in origin, runs an infrastructure made up of a “complex set of sub-teams and groups, [..] has huge numbers of compromised devices at its command and employs a highly distributed professional workflow to maintain security and a high operational tempo.” <\/p>\n

Today's more sophisticated cybercriminal operations, whether purely for profit or working for state interests — as with many advanced persistent threat (APT) groups — often operate business-style models. This includes hiring top talent and creating a financial framework to deposit, transfer, and launder proceeds. <\/p>\n

In Wizard Spider's case, this also means pouring some of its profits back into development with investments in tools and software, and paying for new hires. The report suggests that the group commands “hundreds of millions of dollars in assets.” <\/p>\n

“The group's extraordinary profitability allows its leaders to invest in illicit research and development initiatives,” the researchers say. “Wizard Spider is fully capable of hiring specialist talent, building new digital infrastructure, and purchasing access to advanced exploits.” <\/p>\n

PRODAFT says that Wizard Spider focuses on compromising enterprise networks and “has a significant presence in almost every developed country in the world, and many emerging economies as well.” <\/p>\n

Victims have included defense contractors, enterprise firms, supply chain vendors, hospitals, and critical utility providers. <\/p>\n

Wizard Spider's attacks tend to start through spam and phishing using QBot and the SystemBC proxy. The group may also infiltrate businesses through compromised email threads between employees in Business Email Compromise (BEC) schemes. <\/p>\n

Once there's a crack in the door, the group will deploy Cobalt Strike and will attempt to grab domain administrator privileges. The Conti ransomware strain is deployed, machines and hypervisor servers are encrypted, and a ransomware demand is made. <\/p>\n

Victims are managed through a locker control panel. <\/p>\n

\"screenshot-2022-05-16-at-16-11-31.png\"<\/span>