Indrik Spider
Indrik Spider is a financially motivated, Russia-based cybercriminal threat actor tracked under aliases including Evil Corp, Gold Drake, Gold Prelude, Manatee Tempest, Mustard Tempest, DEV-0206, DEV-0243, TA569, UNC1543, and UNC2165. The content directly links Indrik Spider/Evil Corp to the Dridex malware ecosystem and describes Evil Corp as a Russia-based cybercriminal group sanctioned by the U.S. Treasury in December 2019. Multiple sources in the content state that U.K. authorities assess links between the actors and the Russia-based group Evil Corp, and that the FSB cultivates and co-opts criminal hackers including Evil Corp. The group is associated in the content with ransomware operations including BitPaymer, WastedLocker, Hades, Grief, Macaw Locker, and Phoenix, with reporting that Hades superseded WastedLocker to circumvent OFAC sanctions and that Evil Corp later shifted toward using ransomware-as-a-service offerings such as LockBit to hinder attribution and reduce sanctions pressure. Operationally, the content states that Indrik Spider used fake Flash Player and Google Chrome updates as initial infection vectors and served fake updates via compromised legitimate websites. It used malicious JavaScript files in several attack components and PowerShell Empire for malware execution. The actor performed reconnaissance using implants and remote execution via WMIC/WMI, and used RDP for lateral movement. For credential access and collection, the content states that Indrik Spider searched files to obtain and exfiltrate credentials, stored collected data in .tmp files, and used a service account to extract copies of the Security registry hive. For defense evasion, it used batch scripts, PsExec to leverage Windows Defender settings to disable scanning of downloaded files and restrict real-time monitoring, MpCmdRun to revert Microsoft Defender definitions, and WMI to stop, uninstall, or reset antivirus products and other defensive services. The content also notes overlaps between Evil Corp and clusters such as UNC2165, including use of the FakeUpdate infection chain, Hades ransomware, Beacon payloads, and shared command-and-control infrastructure. Reporting cited in the content identifies DEV-0243 activity as falling under Evil Corp and states that UNC2165 has numerous overlaps with Evil Corp. Known associated sub-groups or rebrands mentioned in the content include Grief and Phoenix.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
61 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
41 malware families attributed to this actor across reporting.
36 additional families tracked in Mallory.
Associated vulnerabilities
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
The vulnerability, identified as CVE-2024-37085, involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation... VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named “ESX Admins” to have full administrative access by default.
GTIG identified UNC2165... leveraging CVE-2025-8088 to distribute malware in mid-July 2025.
CVE-2026-41940, the cPanel authentication bypass, illustrates the opportunistic mass-exploitation pattern most clearly. What began as exploratory probing evolved into a multi-actor campaign combining ransomware deployment, website defacement, and — in at least one documented case — targeted cyber-espionage.
Observables
448 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses compromised legitimate websites and web inject-based attack chains, leveraging non-malicious email communications to direct victims to compromised assets.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Referenced as a threat actor associated with registry modification behavior (MITRE ATT&CK T1112: Modify Registry) in the context of this detection analytic.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.