EvilCorp

EvilCorp is a financially motivated cybercriminal threat actor with reported connections to the Russian government and is sanctioned by the U.S. Treasury, including in relation to ransom payments. The group is associated in the provided content with ransomware and initial-access activity, including attribution of the WastedLocker ransomware to EvilCorp. The content also states that DoppelPaymer evolved from EvilCorp, and that Grief is an offshoot of DoppelPaymer, linking those groups by lineage. The actor is referenced alongside aliases and related cluster names including UNC2165, Indrik Spider, and Microsoft’s Manatee Tempest / DEV-0243. UNC2165 is described as associated with or closely linked to EvilCorp. Reporting in the content links UNC2165 to the ViperTunnel Python backdoor, which is often deployed after FAKEUPDATES/SocGholish infections, establishes persistent access, creates a SOCKS5 proxy over port 443, and is often used with the ShadowCoil credential stealer. SocGholish is also described as a key initial access vector for ransomware groups linked to EvilCorp and has delivered follow-on tooling such as Cobalt Strike, NetSupport, and WastedLocker. The content further states that Mandiant associated EvilCorp with use of LockBit ransomware in some attacks, and that EvilCorp allegedly used LockBit without LockBit’s consent to evade sanctions. Additional reporting cited in the content notes alleged ties or associations between EvilCorp and other major criminal ecosystems or actors, including FIN7, Wizard Spider, and possibly Mikhail Matveev (Wazawaka). The content also notes public reporting that members of groups like EvilCorp have flaunted wealth publicly in Moscow.