Indrik Spider

Threat Actors · Indrik Spider

· ATT&CK GroupG0119

Evil CorpManatee TempestDEV-0243UNC2165

Techniques

Software

Tactics

Aliases

Description

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Tactic Coverage

execution (5)persistence (5)credential access (4)defense impairment (4)resource development (4)discovery (3)stealth (3)privilege escalation (3)lateral movement (2)initial access (2)impact (2)collection (1)command and control (1)exfiltration (1)reconnaissance (1)

Techniques Used (33)

T1003.001LSASS Memory

credential access

T1007System Service Discovery

discovery

T1012Query Registry

discovery

T1018Remote System Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 33 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (8)

S0570BitPaymermalware S0154Cobalt Strikemalware S0695Donuttool S0384Dridexmalware S0363Empiretool S0002Mimikatztool S0029PsExectool S0612WastedLocker

References (10)

https://attack.mitre.org/groups/G0119 https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/https://home.treasury.gov/news/press-releases/sm845