Loading threat actor…
Evil Corp, also known as INDRIK SPIDER and GOLD DRAKE, is a Russia-based, financially motivated cybercriminal group active since at least 2007. Associated tracking names include DEV-0243 and MANATEE TEMPEST. UNC2165 is a financially motivated activity cluster with significant overlap with Evil Corp. The group is best known for developing and distributing the Dridex banking trojan and conducting targeted ransomware operations against enterprise networks, including financial institutions in the United States. Evil Corp distributes Dridex through phishing emails, malicious attachments, and document macros. Dridex steals banking credentials through browser manipulation and keylogging, exfiltrates captured information, and delivers additional malware. The group expanded from banking fraud into targeted, high-value ransomware attacks, deploying BitPaymer to encrypt domain-controlled systems. Its documented post-compromise techniques include credential dumping with ProcDump through Cobalt Strike, Active Directory computer enumeration with PowerView, and batch-script execution. Evil Corp has also been linked to the SocGholish malware-distribution ecosystem. The U.S. Treasury Department sanctioned Evil Corp in December 2019. The group subsequently changed operational branding and ransomware variants to circumvent sanctions-related payment restrictions; associated ransomware names include WastedLocker, Hades, and Phoenix. UNC2165 has conducted multiple attacks using LockBit ransomware, although this does not establish that Evil Corp controls the LockBit operation. Evil Corp has documented links to the Russian state, while its dominant operational motivation remains financial gain.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
162 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
60 malware families Mallory has associated with this actor across public reporting.
55 additional families tracked in Mallory.
5 CVEs Mallory has associated with this actor across public reporting. 5 of them are exploited in the wild (not necessarily by this actor).
252 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.