MITRE ATT&CKgroup

G0119 Indrik Spider

Published 2021-01-06 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Evil Corp, Manatee Tempest, DEV-0243, UNC2165
Version
4.1
Created
2021-01-06

Description

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.

Related

Uses · MITRE ATT&CK (41)

  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • S0695 Donut software (tool)
  • S0612 WastedLocker software (malware)
  • S0570 BitPaymer software (malware)
  • T1555.005 Password Managers sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1590 Gather Victim Network Information technique
  • T1584.004 Server sub-technique
  • T1585.002 Email Accounts sub-technique
  • T1587.001 Malware sub-technique
  • T1583 Acquire Infrastructure technique
  • T1059.007 JavaScript sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.004 SSH sub-technique
  • T1558.003 Kerberoasting sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1552.001 Credentials In Files sub-technique
  • T1136.001 Local Account sub-technique
  • S0384 Dridex software (malware)
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • S0363 Empire software (tool)
Show all 41 ›

References