modified: 2024-10-28T19:11:56.485Z
name: Indrik Spider
description: [Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)
aliases: Indrik Spider
Evil Corp
Manatee Tempest
DEV-0243
UNC2165
x_mitre_deprecated: no
x_mitre_version: 4.1
x_mitre_contributors: Jennifer Kim Roman, CrowdStrike
Liran Ravich, CardinalOps
type: intrusion-set
spec_version: 2.1
id: intrusion-set--01e28736-2ffc-455b-9880-ed4d1407ae07
created: 2021-01-06T17:46:35.134Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0119
external_id: G0119
source_name: Evil Corp
description: (Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)
source_name: UNC2165
description: (Citation: Mandiant_UNC2165)
source_name: Manatee Tempest
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: DEV-0243
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Crowdstrike Indrik November 2018
description: Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
url: https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/
source_name: Mandiant_UNC2165
description: Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Crowdstrike EvilCorp March 2021
description: Podlosky, A., Feeley, B. (2021, March 17). INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions. Retrieved September 15, 2021.
url: https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/
source_name: Treasury EvilCorp Dec 2019
description: U.S. Department of Treasury. (2019, December 5). Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware. Retrieved September 15, 2021.
url: https://home.treasury.gov/news/press-releases/sm845
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5