WIZARD SPIDER has developed their tools over a number of years, and they continue to evolve the tactics, techniques and procedures (TTPs) needed to monetize their criminal operations in an efficient and effective manner. TrickBot . TrickBot has remained a primary tool for WIZARD SPIDER and has grown to infect upward of one million systems worldwide. This has made WIZARD SPIDER’s TrickBot malware an extremely prevalent and widely tracked target. However, in spite of this, TrickBot activity has returned to its usual rapid pace, and the impact of the disruption operation was manifested as a short-term setback for WIZARD SPIDER. Ryuk’s Return . Since September 2018, WIZARD SPIDER’s Ryuk ransomware has been the group’s most lucrative operation for siphoning money from its victims through extortion. It is possible that Conti and Ryuk may continue to be used simultaneously by WIZARD SPIDER, with either one being deployed depending on particular characteristics of the victim organization. Conti has been continually improved by WIZARD SPIDER and has already been used to compromise over 120 victim networks, with stolen data listed on the Conti DLS. Conti victims span multiple sectors and geographies, the vast majority of which are based in North America and Europe (Figure 4). This opportunistic targeting is indicative of WIZARD SPIDER and wider ransomware operations. Conti Ransomware Victims by Sector and Geography (click image to enlarge) . Conti has been under active development throughout WIZARD SPIDER’s deployment of the ransomware in BGH campaigns. WIZARD SPIDER, with its diverse and effective toolset, has proven to be a highly capable adversary and continues to be resilient, reactive and resolute as they continue to run their formidable criminal enterprise