INDRIK SPIDER

Evil Corp, also tracked as Indrik Spider, Gold Drake, DEV-0243, Manatee Tempest, and UNC2165, is a long-running Russian cybercrime group best known for operating the Dridex malware ecosystem and later conducting targeted ransomware intrusions. The group has been active since at least the mid-2010s and has been publicly linked to financially motivated operations involving banking trojans, large-scale malspam, malware loaders, and enterprise ransomware. U.S. sanctions imposed in 2019 against Evil Corp members are widely associated with the group’s subsequent rebranding and tooling changes. Evil Corp built much of its reputation through Dridex, a modular banking trojan and malware delivery platform used to steal banking credentials, capture screenshots, perform keylogging and browser-injection activity, and deliver additional payloads. Dridex campaigns relied heavily on phishing emails, malicious attachments, macro-enabled documents, compressed archives, and social engineering. The group also used fake software-update lures and compromised legitimate websites to deliver malware through the SocGholish framework, which has been observed distributing Dridex, NetSupport RAT, WastedLocker, and Hades. Over time, Evil Corp shifted from broad banking-malware activity toward targeted post-compromise ransomware operations. Dridex infections were used to gain footholds that later enabled deployment of BitPaymer, and the group has also been linked with WastedLocker, Hades, and Entropy-related activity. WastedLocker is strongly associated with Evil Corp and was used in targeted attacks against large enterprises, particularly in North America. Hades has been assessed as a later variant derived from WastedLocker and used in part to evade sanctions-related scrutiny. Reporting has also linked Evil Corp to Locky campaigns and to broader malware spam operations, though some historical reporting overlaps with TA505 and should be treated carefully where attribution is not exclusive. Operationally, Evil Corp combines initial access, malware staging, persistence, reconnaissance, credential theft, lateral movement, and hands-on-keyboard post-exploitation. Observed tradecraft includes PowerShell execution, use of batch scripts, downloading additional tools and malware onto compromised hosts, abuse of compromised servers and websites for staging or fake-update delivery, credential harvesting from files, and use of Cobalt Strike and legitimate administrative utilities for internal movement and ransomware deployment. In ransomware intrusions, the group has been observed prioritizing high-value enterprise systems, including file servers, databases, virtualized infrastructure, and systems tied to business operations. The group’s dominant motivation is financial gain. Its activity spans banking fraud enablement, credential theft, malware delivery, and high-value ransomware monetization. Evil Corp remains one of the most prominent Russian cybercriminal actors associated with the evolution from banking trojans to targeted enterprise ransomware.