EvilCorp

EvilCorp is a financially motivated cybercrime group with reported connections to the Russian government; the content states the group is sanctioned in connection with those ties, including sanctions implications for ransom payments. The reporting links EvilCorp to ransomware and intrusion activity and describes it as associated with UNC2165 and Microsoft’s DEV-0243 / Manatee Tempest naming. The content also references the alias Indrik Spider. The group is described as tied to or descended into multiple ransomware lines. The content states DoppelPaymer evolved from EvilCorp, and that Grief is an offshoot of DoppelPaymer, making Grief part of EvilCorp’s broader lineage. Separate reporting cited in the content says Mandiant associated UNC2165/EvilCorp activity with use of LockBit ransomware, and that EvilCorp allegedly used LockBit payloads without LockBit’s consent to evade sanctions. The content links EvilCorp-associated activity to malware delivery and persistence tooling. SocGholish / FAKEUPDATES is described as a key initial access vector used by major ransomware groups including those linked to EvilCorp. ViperTunnel, a Python backdoor observed in UK and US business networks, is assessed in the content as likely tied to UNC2165, a cluster closely linked to EvilCorp; ViperTunnel is often deployed after SocGholish infections, establishes persistent access, creates a SOCKS5 proxy over port 443, abuses Python sitecustomize.py for execution, and is often used alongside the ShadowCoil credential stealer. The content also notes ecosystem relationships and associations: Prodaft reporting mentioned possible association between Mikhail Matveev/Wazawaka and the EvilCorp group; and reporting on LockBit infiltration cited alleged ties between LockBit affiliate structures and FIN7, Wizard Spider, and EvilCorp. Additional contextual reporting in the content describes EvilCorp as a prominent Russian cybercriminal group that has publicly flaunted wealth in Moscow.