- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime; Financial gain
- Seen
- 2007–2026
- Status
- Active
- ATT&CK
- G0119 · 33 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0028 · indrik-spider
RussiaWhat it is
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Doppel Spider
- Mandiant
- UNC2165
- Microsoft
- Manatee Tempest, DEV-0243, Mustard Tempest
- MITRE ATT&CK
- G0119
- PwC
- Blue Lelantos
- Other names
- Evil Corp, GOLD WINTER, BitPaymer, doppel paymer, DoppelPaymer, DoppelPaymer gang, DoppelPaymer group, DoppelPaymer ransomware, EvilCorp, FriedEx, Gold Drake, Gold Heron, Grief Group, IEncrypt, Pay OR Grief
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRussia
- MISP Galaxy (CFR tagging)Russia
- MicrosoftRussia
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Austria, Brazil, Canada, Chile, Dominican Republic, France, Germany, Greece, Italy, Mexico, Portugal, Spain, Switzerland, Thailand, United Kingdom, United States
- Sectors
- Financial, Government, Healthcare, Manufacturing, Media
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- BitPaymer
- BitPaymer ransomware
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Donut
- DoppelDridex
- DoppelPaymer
- Dridex
- Empire
- Grief
- Mimikatz
- PowerShell Empire
- PsExec
- Trojan.Karagany
- Trojan.Mebromi
- WastedLocker
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de