{ "id": "015b8886-c851-45ef-b5f4-912083ebad39", "created_at": "2026-04-06T00:19:57.191444Z", "updated_at": "2026-04-10T03:36:36.74163Z", "deleted_at": null, "sha1_hash": "21e79ade5f18d6a6a7d9a7f112f5f2854334cf60", "title": "Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 87002, "plain_text": "Indrik Spider - Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 16:13:34 UTC\r\nHome \u003e List all groups \u003e Indrik Spider\r\n APT group: Indrik Spider\r\nNames\r\nIndrik Spider (CrowdStrike)\r\nGold Drake (SecureWorks)\r\nGold Winter (SecureWorks)\r\nEvil Corp (self given)\r\nUNC2165 (Mandiant)\r\nDEV-0243 (Microsoft)\r\nManatee Tempest (Microsoft)\r\nMustard Tempest (Microsoft)\r\nBlue Lelantos (PWC)\r\nG0119 (MITRE)\r\nCountry Russia\r\nMotivation Financial crime, Financial gain\r\nFirst seen 2007\r\nDescription (CrowdStrike) Indrik Spider is a sophisticated eCrime group that has been operating Dridex\r\nsince June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking\r\nrojans on the market and, since 2014, those efforts are thought to have netted Indrik Spider\r\nmillions of dollars in criminal profits. Throughout its years of operation, Dridex has\r\nreceived multiple updates with new modules developed and new anti-analysis features\r\nadded to the malware.\r\nIn August 2017, a new ransomware variant identified as BitPaymer was reported to have\r\nransomed the U.K.’s National Health Service (NHS), with a high ransom demand of 53\r\nBTC (approximately $200,000 USD). The targeting of an organization rather than\r\nindividuals, and the high ransom demands, made BitPaymer stand out from other\r\ncontemporary ransomware at the time. Though the encryption and ransom functionality of\r\nBitPaymer was not technically sophisticated, the malware contained multiple anti-analysis\r\nfeatures that overlapped with Dridex. Later technical analysis of BitPaymer indicated that it\r\nhad been developed by Indrik Spider, suggesting the group had expanded its criminal\r\noperation to include ransomware as a monetization strategy.\r\nIndrik Spider appears to be a subgroup of TA505, Graceful Spider, Gold Evergreen. In\r\n2019, a subgroup of Indrik Spider split off into Doppel Spider.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6\r\nPage 1 of 4\n\nDridex has been observed to be distributed via Necurs (operated by Monty Spider) and\nEmotet (operated by Mummy Spider, TA542).\nObserved\nSectors: Financial, Government, Healthcare, Media.\nCountries: Worldwide.\nTools used\nAdvanced Port Scanner, Babuk Locker, BitPaymer, Cobalt Strike, Cridex, Dridex,\nEmpireProject, Hades, Macaw Locker, MEGAsync, Metasploit, Mimikatz, PayloadBIN,\nPhoenix, PowerSploit, PsExec, Raspberry Robin, SocGholish, WastedLoader,\nWastedLocker.\nOperations performed\nAug 2017\nSeveral hospitals part of the NHS Lanarkshire board were hit on Friday by a\nversion of the Bit Paymer ransomware.\nThe NHS Lanarkshire board includes hospitals such as Hairmyres Hospital in\nEast Kilbride, Monklands Hospital in Airdrie and Wishaw General Hospital.\nJul 2018\nBitPaymer Ransomware Paralyzes IT Systems of the Alaskan Town\nJan 2019\nArizona Beverages knocked offline by ransomware attack\nMay 2019\nBitPaymer Ransomware Leveraging New Custom Packer Framework Against\nTargets Across the U.S.\nAug 2019\nApple Zero-Day Exploited in New BitPaymer Campaign\nOct 2019\nPilz, one of the world's largest producers of automation tools, has been down\nfor more than a week after suffering a ransomware infection.\nNov 2019\nEveris, an NTT DATA company and one of Spain's largest managed service\nproviders (MSP), had its computer systems encrypted today in a ransomware\nattack, just as it happened to Spain's largest radio station Cadena SER\n(Sociedad Española de Radiodifusión).\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6\nPage 2 of 4\n\nMay 2020\nWastedLocker: A New Ransomware Variant Developed By The Evil Corp\nGroup\nJul 2020\nGarmin services and production go down after ransomware attack\nDec 2020\nINDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to\nCircumvent OFAC Sanctions\nMar 2021\nInsurance giant CNA hit by new Phoenix CryptoLocker ransomware\nMay 2021\nRIG Exploit Kit delivers WastedLoader malware\nJun 2021\nNew Evil Corp ransomware mimics PayloadBin gang to evade US sanctions\nSep 2021\nTrucking giant Forward Air reports ransomware data breach\nOct 2021\nSinclair Broadcast Hack Linked to Notorious Russian Cybergang\nOct 2021\nOlympus US systems hit by cyberattack over the weekend\nDec 2021\nDridex malware trolls employees with fake job termination emails\nDec 2021\nDridex Omicron phishing taunts with funeral helpline number\nCounter operations Oct 2015 In the fall of 2015, the Dell SecureWorks Counter Threat Unit (CTU) research\nteam collaborated with the UK National Crime Agency (NCA), the U.S.\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6\nPage 3 of 4\n\nFederal Bureau of Investigation (FBI), and the Shadowserver Foundation to\ntake over the Dridex banking trojan.\nDec 2019\nRussian National Charged with Decade-Long Series of Hacking and Bank\nFraud Offenses Resulting in Tens of Millions in Losses and Second Russian\nNational Charged with Involvement in Deployment of “Bugat” Malware\nDec 2019\nTreasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind\nDridex Malware\nOct 2024\nTreasury Sanctions Members of the Russia-Based Cybercriminal Group Evil\nCorp in Tri-Lateral Action with the United Kingdom and Australia\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://apt.etda.or.th/cgi-bin/showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6" ], "report_names": [ "showcard.cgi?u=a13e6ede-eb86-499f-837e-820845da04a6" ], "threat_actors": [ { "id": "8670f370-1865-4264-9a1b-0dfe7617c329", "created_at": "2022-10-25T16:07:23.69953Z", "updated_at": "2026-04-10T02:00:04.716126Z", "deleted_at": null, "main_name": "Hades", "aliases": [ "Operation TrickyMouse" ], "source_name": "ETDA:Hades", "tools": [ "Brave Prince", "Gold Dragon", "GoldDragon", "Lovexxx", "Olympic Destroyer", "Running RAT", "RunningRAT", "SOURGRAPE", "running_rat" ], "source_id": "ETDA", "reports": null }, { "id": "d0338f31-ace4-4fec-972b-d1ba9815d1de", "created_at": "2023-01-06T13:46:39.283728Z", "updated_at": "2026-04-10T02:00:03.273567Z", "deleted_at": null, "main_name": "GOLD WINTER", "aliases": [], "source_name": "MISPGALAXY:GOLD WINTER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "e8e18067-f64b-4e54-9493-6d450b7d40df", "created_at": "2022-10-25T16:07:24.515213Z", "updated_at": "2026-04-10T02:00:05.018868Z", "deleted_at": null, "main_name": "Mummy Spider", "aliases": [ "ATK 104", "Gold Crestwood", "Mummy Spider", "TA542" ], "source_name": "ETDA:Mummy Spider", "tools": [ "Emotet", "Geodo", "Heodo" ], "source_id": "ETDA", "reports": null }, { "id": "748eb9f3-ef15-4645-881b-b91681111812", "created_at": "2022-10-25T16:07:24.510024Z", "updated_at": "2026-04-10T02:00:05.016515Z", "deleted_at": null, "main_name": "Monty Spider", "aliases": [ "Gold Riverview" ], "source_name": "ETDA:Monty Spider", "tools": [ "Necurs", "nucurs" ], "source_id": "ETDA", "reports": null }, { "id": "91ff2504-6c1a-4eaa-832b-2c5e297426c5", "created_at": "2022-10-25T16:47:55.740817Z", "updated_at": "2026-04-10T02:00:03.678203Z", "deleted_at": null, "main_name": "GOLD EVERGREEN", "aliases": [ "The Business Club" ], "source_name": "Secureworks:GOLD EVERGREEN", "tools": [ "CryptoLocker", "JabberZeus", "Pony", "Zeus" ], "source_id": "Secureworks", "reports": null }, { "id": "506404b2-82fb-4b7e-b40d-57c2e9b59f40", "created_at": "2023-01-06T13:46:38.870883Z", "updated_at": "2026-04-10T02:00:03.128317Z", "deleted_at": null, "main_name": "MUMMY SPIDER", "aliases": [ "TA542", "GOLD CRESTWOOD" ], "source_name": "MISPGALAXY:MUMMY SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "50068c14-343c-4491-b568-df41dd59551c", "created_at": "2022-10-25T15:50:23.253218Z", "updated_at": "2026-04-10T02:00:05.234464Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Indrik Spider", "Evil Corp", "Manatee Tempest", "DEV-0243", "UNC2165" ], "source_name": "MITRE:Indrik Spider", "tools": [ "Mimikatz", "PsExec", "Dridex", "WastedLocker", "BitPaymer", "Cobalt Strike" ], "source_id": "MITRE", "reports": null }, { "id": "2eb5ae35-e3ae-4b76-a945-5e6c2cfc1942", "created_at": "2024-02-02T02:00:04.028297Z", "updated_at": "2026-04-10T02:00:03.530787Z", "deleted_at": null, "main_name": "Mustard Tempest", "aliases": [ "DEV-0206", "Purple Vallhund" ], "source_name": "MISPGALAXY:Mustard Tempest", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "ebc139d2-7450-46f5-a9e4-e7d561133fa5", "created_at": "2024-04-24T02:00:49.453475Z", "updated_at": "2026-04-10T02:00:05.321256Z", "deleted_at": null, "main_name": "Mustard Tempest", "aliases": [ "Mustard Tempest", "DEV-0206", "TA569", "GOLD PRELUDE", "UNC1543" ], "source_name": "MITRE:Mustard Tempest", "tools": [ "SocGholish", "Cobalt Strike" ], "source_id": "MITRE", "reports": null }, { "id": "b296f34c-c424-41da-98bf-90312a5df8ef", "created_at": "2024-06-19T02:03:08.027585Z", "updated_at": "2026-04-10T02:00:03.621193Z", "deleted_at": null, "main_name": "GOLD DRAKE", "aliases": [ "Evil Corp", "Indrik Spider ", "Manatee Tempest " ], "source_name": "Secureworks:GOLD DRAKE", "tools": [ "BitPaymer", "Cobalt Strike", "Covenant", "Donut", "Dridex", "Hades", "Koadic", "LockBit", "Macaw Locker", "Mimikatz", "Payload.Bin", "Phoenix CryptoLocker", "PowerShell Empire", "PowerSploit", "SocGholish", "WastedLocker" ], "source_id": "Secureworks", "reports": null }, { "id": "8ada819f-dec0-4de4-97eb-0a8aff899c56", "created_at": "2023-01-06T13:46:39.225531Z", "updated_at": "2026-04-10T02:00:03.251546Z", "deleted_at": null, "main_name": "GOLD EVERGREEN", "aliases": [], "source_name": "MISPGALAXY:GOLD EVERGREEN", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d706edf6-cb86-4611-99e1-4b464e9dc5b9", "created_at": "2023-01-06T13:46:38.839083Z", "updated_at": "2026-04-10T02:00:03.117987Z", "deleted_at": null, "main_name": "INDRIK SPIDER", "aliases": [ "Manatee Tempest" ], "source_name": "MISPGALAXY:INDRIK SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "5e6b31a6-80e3-4e7d-8b0a-d94897ce9b59", "created_at": "2024-06-19T02:03:08.128175Z", "updated_at": "2026-04-10T02:00:03.636663Z", "deleted_at": null, "main_name": "GOLD TAHOE", "aliases": [ "Cl0P Group Identity", "FIN11 ", "GRACEFUL SPIDER ", "SectorJ04 ", "Spandex Tempest ", "TA505 " ], "source_name": "Secureworks:GOLD TAHOE", "tools": [ "Clop", "Cobalt Strike", "FlawedAmmy", "Get2", "GraceWire", "Malichus", "SDBbot", "ServHelper", "TrueBot" ], "source_id": "Secureworks", "reports": null }, { "id": "3bf456e4-84ee-48fd-b3ab-c10d54a48a34", "created_at": "2024-06-19T02:03:08.096988Z", "updated_at": "2026-04-10T02:00:03.82859Z", "deleted_at": null, "main_name": "GOLD PRELUDE", "aliases": [ "Mustard Tempest ", "TA569 ", "UNC1543 " ], "source_name": "Secureworks:GOLD PRELUDE", "tools": [ "SocGholish" ], "source_id": "Secureworks", "reports": null }, { "id": "75d4d6a9-b5d1-4087-a7a0-e4a9587c45f4", "created_at": "2022-10-25T15:50:23.5188Z", "updated_at": "2026-04-10T02:00:05.26565Z", "deleted_at": null, "main_name": "TA505", "aliases": [ "TA505", "Hive0065", "Spandex Tempest", "CHIMBORAZO" ], "source_name": "MITRE:TA505", "tools": [ "AdFind", "Azorult", "FlawedAmmyy", "Mimikatz", "Dridex", "TrickBot", "Get2", "FlawedGrace", "Cobalt Strike", "ServHelper", "Amadey", "SDBbot", "PowerSploit" ], "source_id": "MITRE", "reports": null }, { "id": "ccd0f6b5-6d20-4d28-9796-88ab6deb4087", "created_at": "2024-06-19T02:03:08.067518Z", "updated_at": "2026-04-10T02:00:03.671628Z", "deleted_at": null, "main_name": "GOLD HERON", "aliases": [ "Doppel Spider " ], "source_name": "Secureworks:GOLD HERON", "tools": [ "Cobalt Strike", "DoppelPaymer", "Dridex", "Grief", "PowerShell Empire" ], "source_id": "Secureworks", "reports": null }, { "id": "9806f226-935f-48eb-b138-6616c9bb9d69", "created_at": "2022-10-25T16:07:23.73153Z", "updated_at": "2026-04-10T02:00:04.729977Z", "deleted_at": null, "main_name": "Indrik Spider", "aliases": [ "Blue Lelantos", "DEV-0243", "Evil Corp", "G0119", "Gold Drake", "Gold Winter", "Manatee Tempest", "Mustard Tempest", "UNC2165" ], "source_name": "ETDA:Indrik Spider", "tools": [ "Advanced Port Scanner", "Agentemis", "Babuk", "Babuk Locker", "Babyk", "BitPaymer", "Bugat", "Bugat v5", "Cobalt Strike", "CobaltStrike", "Cridex", "Dridex", "EmPyre", "EmpireProject", "FAKEUPDATES", "FakeUpdate", "Feodo", "FriedEx", "Hades", "IEncrypt", "LINK_MSIEXEC", "MEGAsync", "Macaw Locker", "Metasploit", "Mimikatz", "PayloadBIN", "Phoenix Locker", "PowerShell Empire", "PowerSploit", "PsExec", "QNAP-Worm", "Raspberry Robin", "RaspberryRobin", "SocGholish", "Vasa Locker", "WastedLoader", "WastedLocker", "cobeacon", "wp_encrypt" ], "source_id": "ETDA", "reports": null }, { "id": "6c4f98b3-fe14-42d6-beaa-866395455e52", "created_at": "2023-01-06T13:46:39.169554Z", "updated_at": "2026-04-10T02:00:03.23458Z", "deleted_at": null, "main_name": "Evil Corp", "aliases": [ "GOLD DRAKE" ], "source_name": "MISPGALAXY:Evil Corp", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "a0d0e1ef-3562-40a8-a021-321db92644d9", "created_at": "2023-01-06T13:46:39.104046Z", "updated_at": "2026-04-10T02:00:03.2146Z", "deleted_at": null, "main_name": "DOPPEL SPIDER", "aliases": [ "GOLD HERON" ], "source_name": "MISPGALAXY:DOPPEL SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "a15363f3-ec73-4a94-a94c-60ffb4925a40", "created_at": "2023-01-06T13:46:39.10693Z", "updated_at": "2026-04-10T02:00:03.215548Z", "deleted_at": null, "main_name": "MONTY SPIDER", "aliases": [ "Spandex Tempest" ], "source_name": "MISPGALAXY:MONTY SPIDER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d555c5da-abe4-42aa-a8cf-77b68905891a", "created_at": "2022-10-25T16:07:23.548385Z", "updated_at": "2026-04-10T02:00:04.65211Z", "deleted_at": null, "main_name": "Doppel Spider", "aliases": [ "Gold Heron", "Grief Group" ], "source_name": "ETDA:Doppel Spider", "tools": [ "Agentemis", "Cobalt Strike", "CobaltStrike", "DoppelPaymer", "Pay OR Grief", "Pay or Grief", "cobeacon" ], "source_id": "ETDA", "reports": null }, { "id": "2ac83159-1d9d-4db4-a176-97be6b7b07c9", "created_at": "2024-06-19T02:03:08.024653Z", "updated_at": "2026-04-10T02:00:03.672512Z", "deleted_at": null, "main_name": "GOLD CRESTWOOD", "aliases": [ "Mummy Spider ", "TA542 " ], "source_name": "Secureworks:GOLD CRESTWOOD", "tools": [ "Emotet" ], "source_id": "Secureworks", "reports": null }, { "id": "80300c2f-309a-43c2-9d01-0357a174ad20", "created_at": "2024-06-19T02:03:08.140588Z", "updated_at": "2026-04-10T02:00:03.6222Z", "deleted_at": null, "main_name": "GOLD WINTER", "aliases": [ "" ], "source_name": "Secureworks:GOLD WINTER", "tools": [ "Advanced Port Scanner", "Cobalt Strike", "Hades", "MEGAsync", "MSBuild", "Metasploit", "Mimikatz", "PsExec", "SocGholish" ], "source_id": "Secureworks", "reports": null }, { "id": "99cb4e5b-8071-4f9e-aa1d-45bfbb6197e3", "created_at": "2023-01-06T13:46:38.860754Z", "updated_at": "2026-04-10T02:00:03.125179Z", "deleted_at": null, "main_name": "TA505", "aliases": [ "SectorJ04", "SectorJ04 Group", "ATK103", "GRACEFUL SPIDER", "GOLD TAHOE", "Dudear", "G0092", "Hive0065", "CHIMBORAZO", "Spandex Tempest" ], "source_name": "MISPGALAXY:TA505", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "e447d393-c259-46e2-9932-19be2ba67149", "created_at": "2022-10-25T16:07:24.28282Z", "updated_at": "2026-04-10T02:00:04.921616Z", "deleted_at": null, "main_name": "TA505", "aliases": [ "ATK 103", "Chimborazo", "G0092", "Gold Evergreen", "Gold Tahoe", "Graceful Spider", "Hive0065", "Operation Tovar", "Operation Trident Breach", "SectorJ04", "Spandex Tempest", "TA505", "TEMP.Warlock" ], "source_name": "ETDA:TA505", "tools": [ "Amadey", "AmmyyRAT", "AndroMut", "Azer", "Bart", "Bugat v5", "CryptFile2", "CryptoLocker", "CryptoMix", "CryptoShield", "Dridex", "Dudear", "EmailStealer", "FRIENDSPEAK", "Fake Globe", "Fareit", "FlawedAmmyy", "FlawedGrace", "FlowerPippi", "GOZ", "GameOver Zeus", "GazGolder", "Gelup", "Get2", "GetandGo", "GlobeImposter", "Gorhax", "GraceWire", "Gussdoor", "Jaff", "Kasidet", "Kegotip", "Kneber", "LOLBAS", "LOLBins", "Living off the Land", "Locky", "MINEBRIDGE", "MINEBRIDGE RAT", "MirrorBlast", "Neutrino Bot", "Neutrino Exploit Kit", "P2P Zeus", "Peer-to-Peer Zeus", "Philadelphia", "Philadephia Ransom", "Pony Loader", "Rakhni", "ReflectiveGnome", "Remote Manipulator System", "RockLoader", "RuRAT", "SDBbot", "ServHelper", "Shifu", "Siplog", "TeslaGun", "TiniMet", "TinyMet", "Trojan.Zbot", "Wsnpoem", "Zbot", "Zeta", "ZeuS", "Zeus" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434797, "ts_updated_at": 1775792196, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/21e79ade5f18d6a6a7d9a7f112f5f2854334cf60.pdf", "text": "https://archive.orkl.eu/21e79ade5f18d6a6a7d9a7f112f5f2854334cf60.txt", "img": "https://archive.orkl.eu/21e79ade5f18d6a6a7d9a7f112f5f2854334cf60.jpg" } }