Indrik Spider
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.
- ATT&CK ID
- G0119
- Origin
- Russia
- Weather family
- Tempest
- Techniques
- 27
- Tools
- 8
Also tracked as Evil Corp · Manatee Tempest · DEV-0243 · UNC2165
Techniques
Reconnaissance
Gather Victim Network Information
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsDevelop Capabilities
Initial Access
Execution
Windows Management InstrumentationCommand and Scripting InterpreterUser Execution
Persistence
Valid AccountsModify RegistryCreate Account
Privilege Escalation
Valid AccountsDomain or Tenant Policy Modification
Stealth
Defense Impairment
Modify RegistryDomain or Tenant Policy ModificationDisable or Modify Tools
Credential Access
OS Credential DumpingUnsecured CredentialsCredentials from Password StoresSteal or Forge Kerberos Tickets
Discovery
System Service DiscoveryQuery RegistryRemote System Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
Data Encrypted for ImpactService Stop
Software
BitPaymer · Cobalt Strike · Donut · Dridex · Empire · Mimikatz · PsExec · WastedLocker