216.73.217.22

Indrik Spider

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:13
Updated at
27/03/2026 01:13
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
42 attack patterns (mitre), 13 malware, 9 indicators, 4 tool

Aliases

Manatee Tempest DEV-0243 UNC2165 Evil Corp

Description

[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (42)

Malware (13)

  • Cobalt Strike uses
    Family
    Published 16/12/2024 14:25 · Modified 16/12/2024 14:25
  • Cobalt Strike - S0154 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:39 · Modified 27/05/2026 21:40
  • WastedLocker
  • NetSupport RAT uses
    Family
    Published 22/05/2026 13:08 · Modified 22/05/2026 13:08
  • Egregor - S0554 uses
    Family
    Published 24/07/2024 08:09 · Modified 24/07/2024 08:09
  • SocGholish uses
    Family
    Published 12/06/2026 21:29 · Modified 12/06/2026 21:29
  • BadSpace uses
    Family
    Published 24/07/2024 08:09 · Modified 24/07/2024 08:09
  • Dridex
  • BitPaymer
  • Zloader uses
    Family
    Published 22/09/2025 19:40 · Modified 22/09/2025 19:40
  • Ryuk - S0446 uses
    Family
    Published 30/09/2025 05:15 · Modified 30/09/2025 05:15
  • RedLine Stealer uses
    Family
    Published 14/12/2024 07:04 · Modified 14/12/2024 07:04
  • Lumma Stealer uses
    Family
    Published 08/06/2026 19:36 · Modified 08/06/2026 19:36

Indicators (9)

  • gitbrancher.com indicates
  • 78ddcf7ce945cfa92e640c53462174b21601506b39dec9731212d7d4ef8aa74d indicates
  • tropicalforestproducts.com indicates
  • asyncawaitapi.com indicates
  • supremeceilings.co.za indicates
  • sticky.oystergardening.name indicates
  • rastek.id indicates
  • http://africa.thesmalladventureguide.com/7nwh~ indicates
  • f0fbc29c86cd84ac18aeeee38de05c32fee95d6fa49425021ce0e3d3b13d2d05 indicates

Tool (4)

  • Donut uses
    The MITRE Corporation Confidence 100

    [Donut](https://attack.mitre.org/software/S0695) is an open source framework used to generate position-independent shellcode.(Citation: Donut Github)(Citation: Introducing Donut) [Donut](https://attack.mitre.org/software/S0695) generated code has been used by multiple threat actors to inject and …

    Published 25/03/2022 14:35 · Modified 27/03/2026 01:07
  • PsExec uses
    The MITRE Corporation Confidence 100

    [PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • Mimikatz uses
    The MITRE Corporation Confidence 100

    [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07
  • Empire uses
    The MITRE Corporation Confidence 100

    [Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents …

    Published 11/03/2019 15:13 · Modified 27/03/2026 01:07