INDRIK SPIDERThreat actor
- dev-0243
- Evil Corp
- gold drake
- manatee tempest
- unc2165
INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking trojans on the market and, since 2014, those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits.From MISP Galaxy
Last reported 27 days ago, by CERT-EU3 reports
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1053.005Scheduled Task
“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”
- T1068Exploitation for Privilege Escalation
“The software requires a password to run and uses the vulnerable driver TfSysMon.sys (T1068) to terminate around 96 processes related to AV and EDR solutions.”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1550.002Pass the Hash
“The credentials can be usernames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Cyber Brief 26-07 - June 2026“…n chain used by cybercrime groups, remediating 14.971 websites infected with SocGholish malware, tied to Russian-speaking threat actor Evil Corp.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“…stributes its own custom ransomware, which is also utilised by other advanced intrusion, including CosmicBeetle, Scattered Spider, and Evil Corp.”
-
Ransomware debris: an analysis of the RansomHub operation“…s caused by intensified law enforcement actions, has enticed experienced cybercriminals including members of the Scattered Spider and Evil Corp groups to collaborate with RansomHub’s operation; improving its capabilities, effectiveness of attacks and consequently the group’s inc…”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- operations[.]inin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.