Indrik Spider

Introduction

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset. Crowdstrike Indrik November 2018 Crowdstrike EvilCorp March 2021 Treasury EvilCorp Dec 2019

Activities and Tactics

Country of Origin: 🇷🇺 Russia

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1003.001 LSASS Memory
• T1587.001 Malware
• T1136 Create Account
• T1112 Modify Registry
• T1036.005 Match Legitimate Resource Name or Location
• T1007 System Service Discovery
• T1583 Acquire Infrastructure
• T1685 Disable or Modify Tools
• T1074.001 Local Data Staging
• T1021.001 Remote Desktop Protocol
• T1555.005 Password Managers
• T1590 Gather Victim Network Information
• T1059.001 PowerShell
• T1078.002 Domain Accounts
• T1552.001 Credentials In Files
• T1567.002 Exfiltration to Cloud Storage
• T1059.003 Windows Command Shell
• T1484.001 Group Policy Modification
• T1047 Windows Management Instrumentation
• T1078 Valid Accounts
• T1486 Data Encrypted for Impact
• T1685.005 Clear Windows Event Logs
• T1136.001 Local Account
• T1018 Remote System Discovery
• T1059.007 JavaScript
• T1585.002 Email Accounts
• T1105 Ingress Tool Transfer
• T1489 Service Stop
• T1012 Query Registry
• T1558.003 Kerberoasting
• T1204.002 Malicious File
• T1021.004 SSH
• T1584.004 Server

ATT&CK technique IDs (denormalized)

• T1003.001
• T1007
• T1012
• T1018
• T1021.001
• T1021.004
• T1036.005
• T1047
• T1059.001
• T1059.003
• T1059.007
• T1074.001
• T1078
• T1078.002
• T1105
• T1112
• T1136
• T1136.001
• T1204.002
• T1484.001
• T1486
• T1489
• T1552.001
• T1555.005
• T1558.003
• T1567.002
• T1583
• T1584.004
• T1585.002
• T1587.001
• T1590
• T1685
• T1685.005

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• Trojan.Karagany:
• Trojan.Mebromi:
• CyberGate:
• Cyber Eye RAT:

MITRE ATT&CK Software

• Donut (S0695) — tool
• Mimikatz (S0002) — tool
• Empire (S0363) — tool
• PsExec (S0029) — tool
• Dridex (S0384) — malware
• WastedLocker (S0612) — malware
• BitPaymer (S0570) — malware
• Cobalt Strike (S0154) — malware

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [6] Crowdstrike Indrik November 2018 Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021. [7] Mandiant_UNC2165 Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024. [8] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [9] Crowdstrike EvilCorp March 2021 Podlosky, A., Feeley, B. (2021, March 17). INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions. Retrieved September 15, 2021. [10] Treasury EvilCorp Dec 2019 U.S. Department of Treasury. (2019, December 5). Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware. Retrieved September 15, 2021.