Indrik Spider - G0119

Created: 2021-01-06T17:46:35.134Z

Modified: 2022-09-15T19:49:18.799Z

Contributors:

Aliases

Indrik Spider,Evil Corp

Description

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Techniques Used

Indrik Spider has stored collected date in a .tmp file.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Indrik Spider has attempted to get users to click on a malicious zipped file.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

Indrik Spider has used

Cobalt Strike to empty log files.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1489|Service Stop|

Indrik Spider has used

PsExec to stop services prior to the execution of ransomware.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|