Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Financially Motivated🇷🇺 RU27 malware familiesExploits CVEs in the wild

Indrik Spider

Also known asDEV-0206DEV-0243Evil CorpGOLD PRELUDEgold_drakeINDRIK SPIDERManatee TempestMustard TempestTA569UNC1543UNC2165

Evil Corp is a Russian-speaking cybercriminal group, also known as Indrik Spider, that has been linked in the provided content to Zeus and Dridex malware and to multiple large-scale ransomware and money-laundering operations. The aliases provided include DEV-0243, Gold Drake, Manatee Tempest, UNC2165, and Indrik Spider. The content also associates Evil Corp with ransomware operations including WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker. The group is repeatedly linked to the SocGholish malware ecosystem. SocGholish, also known as FakeUpdates, is described as a dropper/loader distributed through fake browser update prompts on compromised websites, especially compromised WordPress sites. The content states that SocGholish has been used as an initial access mechanism and that it helped criminals gain access to computer systems. Multiple sources in the content say SocGholish is linked to Evil Corp, and some reporting describes it as a key infection chain used by the group. The content also states that SocGholish has allegedly provided initial access to victims for Evil Corp since at least 2018. The content further notes that SocGholish operators have been tracked separately under aliases including DEV-0206, Gold Prelude, Mustard Tempest, TA569, and UNC1543, and that this activity acts as an initial access broker associated with Evil Corp. Reporting in the content also references Maksim Yakubets in connection with Evil Corp. Operation Endgame reporting cited in the content describes law enforcement disruption of infrastructure tied to SocGholish and Evil Corp, including server and domain seizures and remediation of compromised websites.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Consumer Services
  • Automobiles & Components

Where they're from

Attributed origin per open-source reporting.

  • RU
MITRE ATT&CK

Tradecraft

25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics35 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
1 technique
T1584×3
Compromise Infrastructure
T1584.001
Domains
T1584.006
Web Services
TA0001
Initial Access
4 techniques
T1078×6
Valid Accounts
T1189×20
Drive-by Compromise
T1190×6
Exploit Public-Facing Application
T1566
Phishing
T1566.002×5
Spearphishing Link
TA0002
Execution
2 techniques
T1059
Command and Scripting Interpreter
T1059.007×7
JavaScript
T1204×5
User Execution
T1204.002×2
Malicious File
TA0003
Persistence
4 techniques
T1078×6
Valid Accounts
T1136
Create Account
T1205×4
Traffic Signaling
T1505
Server Software Component
T1505.003×2
Web Shell
TA0004
Privilege Escalation
1 technique
T1078×6
Valid Accounts
TA0005
Stealth
5 techniques
T1027
Obfuscated Files or Information
T1036×6
Masquerading
T1078×6
Valid Accounts
T1205×4
Traffic Signaling
T1497×2
Virtualization/Sandbox Evasion
T1497.001×2
System Checks
TA0006
Credential Access
2 techniques
T1056
Input Capture
T1110
Brute Force
T1110.003×3
Password Spraying
TA0007
Discovery
2 techniques
T1082
System Information Discovery
T1497×2
Virtualization/Sandbox Evasion
T1497.001×2
System Checks
TA0009
Collection
1 technique
T1056
Input Capture
TA0011
Command and Control
4 techniques
T1071×9
Application Layer Protocol
T1105×8
Ingress Tool Transfer
T1205×4
Traffic Signaling
T1219×2
Remote Access Tools
WEAPONIZED

Associated vulnerabilities

4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence3

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

CVE-2024-37085VMware ESXi Active Directory Integration Authentication BypassIn the wildEvidence1

The vulnerability, identified as CVE-2024-37085, involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation... VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named “ESX Admins” to have full administrative access by default.

CVE-2025-8088WinRAR Windows Path Traversal via NTFS Alternate Data StreamsIn the wildEvidence1

GTIG identified UNC2165... leveraging CVE-2025-8088 to distribute malware in mid-July 2025.

CVE-2026-41940cPanel & WHM Authentication Bypass via Session-File CRLF InjectionIn the wildEvidence1

CVE-2026-41940, the cPanel authentication bypass, illustrates the opportunistic mass-exploitation pattern most clearly. What began as exploratory probing evolved into a multi-actor campaign combining ransomware deployment, website defacement, and — in at least one documented case — targeted cyber-espionage.

IOCS

Observables

450 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping25

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal27

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs4

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables450

Domains, IPs, and hashes tied to this actor, refreshed continuously.