← Back to Actors
Indrik Spider
Indrik SpiderEvil CorpManatee TempestDEV-0243UNC2165
[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their...
35
Techniques
33
Covered
2
Gaps
94%
Coverage
Coverage33/35
COVERED (33)
T1003.001LSASS Memory111 det.T1007System Service Discovery15 det.T1012Query Registry25 det.T1018Remote System Discovery52 det.T1021.001Remote Desktop Protocol55 det.T1021.004SSH38 det.T1036.005Match Legitimate Resource Name or Location49 det.T1047Windows Management Instrumentation88 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.007JavaScript64 det.T1070.001Clear Windows Event Logs16 det.T1074.001Local Data Staging10 det.T1078Valid Accounts320 det.T1078.002Domain Accounts28 det.T1105Ingress Tool Transfer199 det.T1112Modify Registry208 det.T1136Create Account40 det.T1136.001Local Account46 det.T1204.002Malicious File468 det.T1484.001Group Policy Modification19 det.T1486Data Encrypted for Impact400 det.T1489Service Stop59 det.T1552.001Credentials In Files62 det.T1555.005Password Managers4 det.T1558.003Kerberoasting35 det.T1562.001Disable or Modify Tools332 det.T1567.002Exfiltration to Cloud Storage33 det.T1583Acquire Infrastructure3 det.T1587.001Malware10 det.T1590Gather Victim Network Information5 det.T1685Disable or Modify Tools281 det.T1685.005Clear Windows Event Logs12 det.