Skip to content

Indrik Spider

IntrusionSet · ATTACK:enterprise:G0119

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0119",
  "title": "Indrik Spider",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0119",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--01e28736-2ffc-455b-9880-ed4d1407ae07",
  "external_id": "G0119",
  "domain": "enterprise",
  "created": "2021-01-06T17:46:35.134Z",
  "modified": "2026-07-31T18:47:34.523Z",
  "version": "4.1",
  "aliases": [
    "Indrik Spider",
    "Evil Corp",
    "Manatee Tempest",
    "DEV-0243",
    "UNC2165"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Evil Corp"
    },
    {
      "source_name": "UNC2165"
    },
    {
      "source_name": "Manatee Tempest"
    },
    {
      "source_name": "DEV-0243"
    },
    {
      "source_name": "Crowdstrike Indrik November 2018",
      "url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
    },
    {
      "source_name": "Mandiant_UNC2165",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Crowdstrike EvilCorp March 2021",
      "url": "https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/"
    },
    {
      "source_name": "Treasury EvilCorp Dec 2019",
      "url": "https://home.treasury.gov/news/press-releases/sm845"
    }
  ]
}

Explicit source assertions (41)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--000aa4d0-315e-40d7-b2b6-76e91ecf0fe8

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b5cb547-b027-4a30-84de-d9d1df2495d0

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1136

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15033f82-efad-4db9-8d4c-015eeeeead64

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cebf654-8955-4be0-b01f-392ffa2bad0a

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f33e27a-6fdf-4121-9e25-a307910b118f

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--342a3da9-79e7-4fdc-8a08-bd7f54caa2ac

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1583

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--451d0efa-51c0-414b-a839-cb44edca7bdc

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d6e2596-a7ed-49af-b24b-dca2ddbb6ef2

Mandiant_UNC2165 · Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5926c79d-b8a7-419a-b789-7e2ff1ee32b9

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59a330b5-9ca3-4888-b81d-ce9e6ce564e5

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1555.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c254f88-f567-43d8-9384-54edcf0cb348

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1590

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--656f1790-2ea7-4690-9d72-0371b90bdafd

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7005793f-b8da-49c5-8985-9d4476c3faaf

Crowdstrike Indrik November 2018 · Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--739217f2-c273-4005-8175-1261a81a1224

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--752dc7ba-6ad9-42a7-a61a-4440bec0e1ea

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a9d20e3-053c-4a5c-87d6-bd72bcdd0d69

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0695

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e2dcce1-8fde-4f88-9e48-13a736c694e3

NCC Group WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8904d69b-a5ab-4e4c-b7c7-c437e7859b8a

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1484.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89500cd9-c663-4b3e-bb20-b8fe1860891a

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89fad9cc-d20b-43c4-a98d-105ff6642f2c

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bdc51e7-d2fd-44fb-bfed-6767b6522405

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8efc016b-af48-4cfd-a117-142a88b7c9d9

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f0596f7-159c-43c0-a848-cffb02fc3c9e

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b41632-a553-4abe-aa68-9ce6898e642d

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5ee5826-e742-4847-9816-d9124827262a

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0384

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa4ac94c-705e-4215-8d52-a97b583b62c5

Crowdstrike Indrik November 2018 · Crowdstrike EvilCorp March 2021 · Treasury EvilCorp Dec 2019

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac9b186f-dfd1-4110-b53e-299652097280

Mandiant_UNC2165 · Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b21266cc-1c7a-4ec5-9f15-5acc771a6560

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2c02ae1-c62a-4811-a913-b0a26f605e38

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8fbce12-deae-4655-ac96-e23ebbeef624

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc156b29-534a-4156-b188-8f4a426a0e6c

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0612

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0f58f34-8f30-4a21-9771-5656ad0f5900

NCC Group WastedLocker June 2020 · Microsoft Ransomware as a Service · SentinelOne SocGholish Infrastructure November 2022 · Crowdstrike EvilCorp March 2021

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9360852-584e-4980-9f9b-f56193bd3fc0

Crowdstrike Indrik November 2018 · Mandiant_UNC2165 · Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcafed44-9d31-4d75-915f-660f5fd62fed

Crowdstrike Indrik November 2018 · Crowdstrike EvilCorp March 2021

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1489

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2763cbf-c068-47b5-a871-3b20a368497f

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e56386ab-5c44-403a-bfaf-dce6c6129c0c

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9ebd661-1095-4638-8231-1ebccf520069

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f30598a2-f1bd-41da-874c-9b883d54790d

Symantec WastedLocker June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f43de92c-7a30-4d24-82d1-4537d4fc3fb2

Mandiant_UNC2165

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1584.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7d3d7fc-e25f-4b1f-b7ea-7c19adb300bd

Crowdstrike Indrik November 2018

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9ca130a-1356-4a0a-9d38-ee7d2f9a51f6

Mandiant_UNC2165 · Microsoft Ransomware as a Service · Crowdstrike EvilCorp March 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.