Indrik Spider
- ID
- G0119
- Associated names
- Evil Corp, Manatee Tempest, DEV-0243, UNC2165
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.[1][2][3]
Techniques used (33)
- T1003.001 LSASS Memory
- T1007 System Service Discovery
- T1012 Query Registry
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1136 Create Account
- T1136.001 Local Account
- T1204.002 Malicious File
- T1484.001 Group Policy Modification
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1552.001 Credentials In Files
- T1555.005 Password Managers
- T1558.003 Kerberoasting
- T1567.002 Exfiltration to Cloud Storage
- T1583 Acquire Infrastructure
- T1584.004 Server
- T1585.002 Email Accounts
- T1587.001 Malware
- T1590 Gather Victim Network Information
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
Software used (8)
- S0002 Mimikatz
- S0029 PsExec
- S0154 Cobalt Strike
- S0363 Empire
- S0384 Dridex
- S0570 BitPaymer
- S0612 WastedLocker
- S0695 Donut