W is for Wizard Spider — The Crime Syndicate That Ran Like a Company

The Alphabet of Actors — Letter W. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE, UNMASKED, NAMED, UNINSTALLED, ARRESTED, WEAPONIZED, DECAPITATED, BURROWED, PRE-POSITIONED, INCORPORATED.

The last several letters have been nation-states — Russia's three services, China's patient intruder. This letter comes back down to crime, but to crime that had grown into something that no longer looks like crime at all. Wizard Spider is the name for the Russia-based criminal enterprise behind some of the most destructive ransomware of the era — TrickBot, Ryuk, and above all Conti — and its distinction in this register is not a clever exploit or a novel target. It is an org chart. When the group's internal communications leaked in 2022, the world saw, for the first time in this kind of detail, what a top-tier cybercrime operation had actually become: not a basement of hoodie-wearing loners, but a company. With salaries. With HR. With a CEO.

That is the thesis of the letter, and it is more unsettling than any zero-day. The register has profiled the technical apex, the destructive apex, the espionage apex. Wizard Spider is the organizational apex — the point at which extortion stopped being a hustle and became an industry, run by people who applied for jobs, drew regular pay in Bitcoin, complained about their managers, and clocked in to build the ransomware that would shut down a hospital or a national health service. The banality is the horror. The most damage this group did was not despite being an ordinary workplace but because it was one: a disciplined, staffed, managed enterprise pointed at extortion the way another company points itself at software or logistics.

This is the letter about cybercrime as a corporation, about the leak that exposed the corporation from the inside, and about the political misjudgment that turned an employee into the whistleblower who did what no police operation had managed to do.

1. The Enterprise: the whole stack under one roof

To understand what made Wizard Spider formidable, you have to place it against the ransomware economy this register has already mapped, because Wizard Spider is the version that owns everything. Letter L profiled a ransomware brand; letter R profiled ransomware-as-a-service, the model where a core team rents its malware to affiliates who do the break-ins; letter Q profiled the loader, the access broker that sells footholds to whoever pays. Those are the specialized firms of a fragmented market, each doing one job and trading with the others. Wizard Spider did all of those jobs itself, in-house, under one operation.

Trace the pipeline it ran end to end. Access came from TrickBot — a banking trojan that evolved into a sprawling loader and botnet — and from BazarLoader, the group's own tools for getting inside a target and establishing a foothold. Escalation and lateral movement came from Cobalt Strike and a disciplined intrusion playbook, documented in this archive down to fine operator detail: a detection rule keyed to Conti's own written recommendation that its affiliates use the esentutl utility to access dumped credential databases; the Atera remote-management agent quietly installed as a backdoor; renamed copies of MegaSync used to exfiltrate data before encryption. And the payload — the extortion itself — came from the group's own ransomware, first Ryuk and later Conti. There was no need to rent a loader or affiliate with a RaaS brand, because the operation was the loader and the ransomware and everything in between.

That vertical integration is the structural insight. A fragmented criminal market is resilient but inefficient; each handoff between the loader crew and the ransomware crew is friction and risk. Wizard Spider internalized the whole chain, and in doing so it achieved what any business achieves by integrating: control, consistency, scale. It could take a target from initial infection to full encryption on its own timeline, with its own people, refining each stage as a repeatable process. The register has shown the ransomware economy as a market of specialists. Wizard Spider is what happens when one of those specialists grows up into a conglomerate that does not need the market at all.

2. The Corporation: what the leak revealed

Everything above could be inferred from the malware. What could not be inferred — what had to be seen from the inside — is how the operation was run, and in 2022 the world got to see it, because the operation's own internal chats spilled into public view. The Conti Leaks are the primary evidence for this letter, and what they showed reframed the entire understanding of elite cybercrime.

Behind Conti was a company. The leaked communications revealed an operation with offices, with employees who drew regular salaries paid in cryptocurrency, with a hiring pipeline that recruited and onboarded new staff — some of them, reportedly, ordinary programmers who did not fully grasp at first what they had signed up for. There was a division of labor into specialized roles: coders who wrote the malware, testers who checked it against antivirus, reverse engineers, system administrators, and negotiators whose job was to sit across a chat window from a victimized company and extract the ransom. There was middle management. There was an HR function that dealt with the frictions any workforce generates. There was a leadership layer, and a figure the chats refer to as "Stern" operating at something like the chief-executive level. And there were the mundane textures of any workplace: complaints about pay, grievances about managers, the grind of people who found the work tedious and the hours long.

Sit with what that means, because it is the letter's whole argument. The people who built the ransomware that crippled hospitals were, in the most literal sense, employees. They woke up, they logged in, they did their assigned tasks, they collected a paycheck, and they went home — and the product of that ordinary working day was extortion at a scale that could disrupt a nation. Evil here did not look like a mastermind in a lair; it looked like a mid-sized software firm with a bad product and worse ethics, staffed by people for whom the destruction of a hospital's systems was a Tuesday deliverable. The Conti Leaks stripped away the mythology of the genius hacker and revealed the truth underneath: that the most dangerous cybercrime had industrialized, that it was a career, and that its lethality came precisely from being run with the discipline and process of a legitimate business. That is what "incorporated" means in this letter's verdict, and it is the finding that should frighten anyone who imagined the enemy was disorganized.

3. The Harm: from hospitals to a national emergency

An org chart is only a curiosity until you see what the company produced, and what Wizard Spider produced reached a scale that no other purely criminal actor in this register matched. This section names the damage, because the corporate banality of the operation must be held against the magnitude of its output.

Ryuk, the group's earlier ransomware, became infamous for targeting healthcare, including a wave of attacks on United States hospitals during the COVID-19 pandemic in 2020 — encrypting the clinical systems of hospitals at the precise moment those systems were most needed, forcing diversions and delays in the middle of a public-health emergency. Then came Conti, and Conti's targets escalated from companies to countries. In May 2021, a Conti attack crippled the Health Service Executive — the entire national health service of Ireland — disrupting care across the country for weeks, forcing hospitals back to paper, delaying appointments and procedures for a nation. And in 2022, a Conti campaign against the government of Costa Rica was so severe that the country declared a national emergency, the first time in history a nation-state formally invoked emergency powers in response to a ransomware attack by a criminal group.

Read that trajectory as the output of the corporation described in the previous section. The HSE attack was not a stunt; it was the product of the same salaried coders and negotiators and managers, executed as ordinary work. A country's health system was brought down, and a country's government was pushed into emergency, by an enterprise whose employees were grumbling about their pay while they did it. This is the collision the letter exists to force: the mundanity of the workplace and the magnitude of the harm, in the same operation, at the same time. The negotiator haggling over a ransom and the patient whose surgery was postponed are joined by one org chart. Wizard Spider is the proof that industrialized crime does industrialized damage — that when you run extortion like a company, you can extort at the scale of a country.

4. The Undoing: brought down by its own politics

Most actors in this register were exposed by their victims or their adversaries — a security firm, a government, a forensic investigator pulling a thread. Wizard Spider was exposed by one of its own, and the reason is a self-inflicted wound that makes this letter's downfall unlike any other.

In February 2022, Russia invaded Ukraine, and the Conti operation did something a disciplined criminal enterprise should never do: it took a public political side. The group issued a statement declaring its full support for the Russian government and threatening retaliation against anyone who moved against Russian interests in cyberspace. For a criminal business whose entire survival depended on keeping its head down and its politics invisible, this was a catastrophic error — and it had an immediate, personal consequence. The declaration reportedly turned an insider, said to be Ukrainian, against the group. That insider had access to the operation's internal communications, and, in the days that followed, leaked years of them to the public: the chats, the payroll, the org chart, the tooling, the negotiations, the whole corporate archive of a criminal company, dumped for the world and every law-enforcement agency to read.

This is the register's clearest case of an actor destroyed from within, and the mechanism is worth marking because it is a genuine vulnerability of the corporate model itself. The more an operation becomes a company — the more people it employs, the more internal communication it generates, the more it depends on a workforce — the more it exposes itself to the oldest failure mode of any organization: the disgruntled insider with access. A lone operator has no one to betray him. A corporation has an HR department, and an HR department implies employees, and employees have loyalties, and loyalties can break — especially when the boss declares allegiance to an army that is, at that moment, invading the employee's homeland. Wizard Spider's greatest strength, its industrial organization, contained the seed of its greatest exposure. It grew big enough to run like a company, and then it was undone by the most company-like failure imaginable: an employee who had had enough, and who took the files on the way out.

5. The Splinter: the brand died, the business did not

The leaks were devastating, and it is tempting to end the story there, with the corporation exposed and the Conti name retired. But the register's discipline is to ask what actually happened next, and what happened next is the pattern that makes ransomware so intractable.

By the middle of 2022, under the weight of the leaks and the intensified pressure that followed, the Conti brand wound down. The name that had crippled Ireland and Costa Rica was retired. But a brand is not an enterprise, and the enterprise did not die — it reorganized. The people, the tooling, and the playbook of Wizard Spider dispersed into successor operations, splintering into a set of new ransomware brands — Black Basta, Karakurt, BlackByte, Zeon, and others — that carried the same tradecraft under fresh names. The corporation did not go out of business; it broke into subsidiaries. Separately, the United States and the United Kingdom moved against the individuals, sanctioning named members associated with the TrickBot and Conti operation in 2023 — real consequence for specific people, imposing cost and constraint, though the sanctioned, being in Russia, remained beyond arrest.

So the honest close is the familiar one this register keeps reaching, in a specifically corporate key. Killing the brand was real and not nothing — it burned the Conti name, scattered the operation, and forced a costly reorganization — but it did not end the business, because the business was never the name. It was the people and the process, and those flowed into new vessels the way the staff of a dissolved company move to new firms in the same industry. The talent that built Conti is now building Black Basta and the rest, applying the same integrated, industrial approach under logos that have not yet been leaked. You can destroy a criminal corporation's brand, and even sanction its executives, and still not remove its workforce from the trade — because a workforce, once trained in an industry, does not un-learn the industry. It just updates its résumé.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that its central move — reading Conti as a "corporation" — is a rhetorical flourish that flatters the group and muddies the analysis, and it deserves a fair hearing.

The argument runs like this. Calling a criminal gang a "company" with a "CEO" and "HR" is a journalistic conceit that imports the vocabulary of legitimate business onto what is, underneath, just a well-resourced crime crew — and the framing risks a kind of glamorization, making the operation sound impressive and orderly when it was a violent extortion racket that hurt sick people. Moreover, the objection continues, the corporate reading over-reads the leaks: internal chats always make any group look more structured than it is, and the presence of roles and payments does not make a criminal conspiracy a "corporation" in any meaningful sense — it makes it a conspiracy that pays its members, which conspiracies have always done. And the "banality of evil" theme, borrowed from far graver history, is doing heavy lifting to make a point about ransomware that could be made plainly: these were criminals, they were organized, they did great harm, full stop. Dressing that in corporate metaphor, the argument concludes, is more literary than analytic.

The dossier grants the risk and defends the frame. The glamorization danger is real, and this letter tries hard to avoid it — it centers the hospitals and the national health service and the patients precisely so the corporate structure is never admired in the abstract but always weighed against the harm it produced; the org chart is presented as the horror, not the achievement. But the corporate reading is not a flourish; it is the most accurate available description, and it matters analytically for a concrete reason. How you understand an adversary determines how you fight it, and treating Wizard Spider as a lone gang of geniuses leads to the wrong defenses, while treating it as an industrial enterprise leads to the right ones — disrupting its recruitment, its payroll and money-laundering, its management and infrastructure, its business model, the way you would degrade a company rather than catch a hacker. The leaks did not merely make the group look structured; they documented salaries, hiring, and an org hierarchy in the group's own words, which is evidence, not metaphor. And the "banality" point is not borrowed for effect; it is the single most important operational fact about modern ransomware — that it is a career staffed by ordinary workers — because it explains why the supply of ransomware operators is so deep and so replaceable, and therefore why killing brands never ends it. The counter-narrative is right to warn against admiring the machine. It is wrong that seeing the machine clearly, as the industrial enterprise it was, is anything other than the most useful thing this letter can do.

7. Verdict — INCORPORATED, and SPLINTERED

Wizard Spider is the letter where cybercrime grew up into an industry — the Russia-based enterprise that ran the whole ransomware pipeline in-house, from the TrickBot loader to the Conti payload, and that, when its internal chats spilled open, turned out to be a company: salaries, hiring, HR, negotiators, an org chart, a boss called Stern, and employees who clocked in to build the software that shut down a national health service. It did state-scale harm with a mid-sized firm's structure, and the banality of its organization is exactly what made it so effective and so frightening.

The verdict's first word is what the leaks revealed it to be: INCORPORATED. Not a gang, not a crew — a corporation, in every functional sense but the legal one, with the departments and the payroll and the management layers of any business, pointed at extortion. This is the organizational apex of the register, the proof that the most dangerous cybercrime is not the work of lone prodigies but of staffed, salaried, managed enterprises that treat the destruction of a hospital's systems as a deliverable. Wizard Spider industrialized extortion, and industrialized extortion is what let a private criminal operation push a country into a national emergency.

The second word is what became of the corporation once it was exposed: SPLINTERED. Undone from the inside by its own political misstep — a public embrace of Russia's invasion that turned an employee into the leaker who dumped the whole archive — the Conti brand wound down, its executives drew sanctions, and its workforce did what a dissolved company's workforce always does: it dispersed into new firms in the same industry, reconstituting as Black Basta and Karakurt and the rest. The name died; the enterprise reorganized. You can burn a criminal corporation's brand and sanction its leaders and still not close the business, because the business is a trained workforce, and a trained workforce simply moves on.

Twenty-five letters deep, Wizard Spider is the register's clearest proof that the enemy is not a person but an industry. The honeypot beneath these words measures the disorganized bottom of that industry every day — the random, chaotic, unmanaged credential brute-forcing and foothold-hunting that is the raw labor of intrusion. Wizard Spider is what that raw labor becomes when someone builds a company around it: the same activity, hired and salaried and managed by an org chart, refined from noise into a pipeline. The honeypot sees the applicant pool; Wizard Spider was the firm that hired them. The vectors do not lie: the stack was integrated, the structure was corporate, the harm reached whole nations, the exposure came from within, and the workforce simply re-formed under new names. Judge the criminal corporation that ran extortion like a business. Then understand why ransomware never ends — because you cannot lay off an industry, and every brand you kill leaves behind a trained workforce updating its résumé for the next one.

The Alphabet of Actors continues. Verdict: INCORPORATED, and SPLINTERED. Confidence: HIGH on Wizard Spider's operation of TrickBot, Ryuk and Conti and on the attacks (HSE Ireland 2021, Costa Rica 2022, Ryuk healthcare 2020); the corporate-structure detail (salaries, HR, org chart, 'Stern') rests on the authenticated 2022 Conti Leaks and is attributed to them; the splintering into successor brands and the 2023 US/UK sanctions of named members are matters of public record, the sanctions being sanctions rather than convictions. HSE Ireland, Costa Rica and hospital patients are centered as the harm. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the enterprise that made extortion a career, the leak that opened its books, and the industry that outlives every brand it burns.