These IOCs were released as part of our threat intelligence research on the WizardSpider Group. The PRODAFT Threat Intelligence team detected and gained visibility into WizardSpider’s ransomware infrastructure and analyzed its findings to gain insight into how the criminal operation works. The group is also known by the various malware variants it uses (Ryuk, Trickbot, and Conti, among others). It is a financially motivated cybercrime group first identified in 2017.