Wizard Spider (Conti / TrickBot) - Ransomware Deployment via PsExec Lateral Move

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.