Home / Threat actors / Indrik Spider

Indrik Spider G0119

🔔 Create alert

Also known as: Evil Corp, Manatee Tempest, DEV-0243, UNC2165

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

41

Techniques

8

Malware and tools

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1590 Gather Victim Network Information

Resource Development

T1583 Acquire Infrastructure T1584.004 Server T1585.002 Email Accounts T1587.001 Malware

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts

Execution

T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.003 Windows Command Shell T1059.007 JavaScript T1204.002 Malicious File

Persistence

T1078 Valid Accounts T1078.002 Domain Accounts T1112 Modify Registry T1136 Create Account T1136.001 Local Account

Privilege Escalation

T1078 Valid Accounts T1078.002 Domain Accounts T1484.001 Group Policy Modification

Stealth

T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.002 Domain Accounts

Defense Impairment

T1112 Modify Registry T1484.001 Group Policy Modification T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory T1552.001 Credentials In Files T1555.005 Password Managers T1558.003 Kerberoasting

Discovery

T1007 System Service Discovery T1012 Query Registry T1018 Remote System Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.004 SSH

Collection

T1074.001 Local Data Staging

Command and Control

T1105 Ingress Tool Transfer

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Impact

T1486 Data Encrypted for Impact T1489 Service Stop

Malware and tools

BitPaymerMalwareS0570
Cobalt StrikeMalwareS0154
DridexMalwareS0384
WastedLockerMalwareS0612
DonutToolS0695
EmpireToolS0363
MimikatzToolS0002
PsExecToolS0029

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.