Evil Corp
Also known as: Indrik Spider, Manatee Tempest, DEV-0243, UNC2165
Evil Corp ran the Dridex banking trojan, which the US Treasury says caused more than $100 million in theft, then moved to targeted ransomware such as BitPaymer and WastedLocker. Because the group is sanctioned, paying it a ransom can create legal risk for victims, and MITRE notes it changed tactics and tooling after the sanctions.
- Public attribution
- A Russia-based cybercriminal group sanctioned by the US Treasury in December 2019; Treasury named Maksim Yakubets as its leader and said he also provided direct assistance to the Russian government.
- Active since
- Around 2014
- Targets
- Banks and financial institutions in over 40 countries
- Large enterprises (ransomware)
Status: Under US sanctions since December 2019 (US Treasury). MITRE notes the group changed tactics and tooling after the sanctions.
Notable campaigns
2014 onwardDridex
Banking trojan used to steal online banking credentials from hundreds of banks.
2017 onwardTargeted ransomware
BitPaymer, WastedLocker and Hades ransomware operations (MITRE ATT&CK).
2019US sanctions and indictment
Treasury sanctioned the group and the DOJ indicted its alleged leader.
Signature ATT&CK techniques
- T1204.002User Execution: Malicious File
- T1059.007Command and Scripting Interpreter: JavaScript
- T1078.002Valid Accounts: Domain Accounts
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting
- T1003.001OS Credential Dumping: LSASS Memory
- T1489Service Stop
- T1486Data Encrypted for Impact
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Block JavaScript and script files from running when downloaded from the internet (fake browser updates are a common lure).
- Use filtering that blocks newly registered and compromised sites.
- Defend against Kerberoasting and credential dumping as for other ransomware groups.
- Check sanctions lists with legal counsel before any ransom decision.