INDRIK SPIDER

Evil Corp is a Russian cybercriminal group active since at least 2007 and widely known for major banking malware, loader, and ransomware operations. The group is strongly associated with the Zeus and Dridex malware ecosystems and has also been linked to SocGholish, a fake-browser-update loader used to obtain initial access through compromised websites. Reported aliases include EvilCorp, Gold Drake, Indrik Spider, DEV-0243, Manatee Tempest, and UNC2165. The group has historically specialized in financially motivated intrusions, including banking fraud, credential theft, malware distribution, and large-scale money laundering. Over time, its operations expanded from banking trojans into ransomware and post-compromise monetization. Evil Corp has been associated with ransomware operations including WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker. It has also been tied to initial-access activity that enabled downstream deployment of additional malware and ransomware. Operationally, Evil Corp has used malware loaders and compromised web infrastructure to gain footholds, notably through SocGholish campaigns that rely on hacked websites and fake browser update lures. The group has been linked to malware and tooling that support persistence, credential access, proxying, tunneling, and post-exploitation. Reporting also links Evil Corp to VIPERTUNNEL, a backdoor that establishes SOCKS5 proxy tunnels and uses staged in-memory execution and encrypted command-and-control. Broader reporting connects the group to credential theft, keylogging, exfiltration, defense evasion, and initial access brokering behavior. Evil Corp is regarded as one of Russia’s most prominent cybercrime organizations and has repeatedly been associated with ransomware-enabling infrastructure, bulletproof hosting usage, and laundering of criminal proceeds. Its activity spans financially driven intrusion chains from initial compromise through credential theft, access resale or reuse, and ransomware deployment.