Threat intelligence / Group

Indrik Spider

[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

41 recorded

Relationships

uses

to Acquire Infrastructure

Technique

uses

Malware

uses

to Clear Windows Event Logs

Technique

uses

to Cobalt Strike

Malware

uses

to Create Account

Technique

uses

to Credentials In Files

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Accounts

Technique

uses

Tool

uses

Malware

uses

to Email Accounts

Technique

uses

Tool

uses

to Exfiltration to Cloud Storage

Technique

uses

to Gather Victim Network Information

Technique

uses

to Group Policy Modification

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Kerberoasting

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Modify Registry

Technique

uses

to Password Managers

Technique

uses

Technique

uses

Tool

uses

to Query Registry

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

Technique

uses

to Service Stop

Technique

uses

to SSH

Technique

uses

to System Service Discovery

Technique

uses

to Valid Accounts

Technique

uses

to WastedLocker

Malware

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

10 external

References

mitre-attack

G0119

Evil Corp

—

UNC2165

—

Manatee Tempest

—

DEV-0243

—

Crowdstrike Indrik November 2018

https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/

Mandiant_UNC2165

https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

Crowdstrike EvilCorp March 2021

https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/

Treasury EvilCorp Dec 2019

https://home.treasury.gov/news/press-releases/sm845