The Wizard Spider cybercriminal group dates all the way back to 2016 and their first attacks with the Trickbot botnet. More recently, Wizard Spider leveraged Ryuk and Conti ransomware and took organizations for tens of millions of dollars. The group also has been tied to a "cartel" made up of three other cybercriminal gangs, all sharing infrastructure, victim data and leak sites and tactics. And just as the sharing of threat intel makes defenses stronger, this sharing of "anti-threat intelligence" means Wizard Spider and their cartel counterparts are only becoming more effective at their craft.

In this webinar, the threat research team at Immersive Labs will run a Red vs. Blue Adversary Simulation demonstrating what the Wizard Spider attackers do and, critically, how you can spot them using logs and some basic IR analysis.

• Lead threat researcher Alex Seymour will play the role of Wizard Spider and use an initial foothold to start exploring, exploiting and pivoting through the network.
• Director of cyber threat research Kev Breen will have to track what the attacker is doing before the inevitable ransomware arrives on the scene.
• In this lively back-and-forth simulation, Alex will work to exploit the network while Kev explains what each stage looks like in logs, using some basic IR skills like decoding PowerShell and more.