Trusted Design

Indrik Spider

アクターID: G0119

· MITRE Pageへのリンク

脅威アクターの詳細

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

脅威アクターの別名・別称

Indrik Spider
Evil Corp
Manatee Tempest
DEV-0243
UNC2165

利用した攻撃手法

• T1047 - Windows Management Instrumentation
• T1033 - System Owner/User Discovery
• T1546.013 - PowerShell Profile
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1600 - Weaken Encryption
• T1606.002 - SAML Tokens
• T1087.002 - Domain Account
• T1165 - Startup Items
• T1559.001 - Component Object Model
• T1003.007 - Proc Filesystem
• T1059.009 - Cloud API
• T1574.008 - Path Interception by Search Order Hijacking
• T1583.004 - Server
• T1547.003 - Time Providers
• T1183 - Image File Execution Options Injection
• T1546.005 - Trap
• T1051 - Shared Webroot
• T1497.002 - User Activity Based Checks
• T1552.008 - Chat Messages
• T1597 - Search Closed Sources
• T1157 - Dylib Hijacking
• T1027 - Obfuscated Files or Information
• T1056 - Input Capture
• T1570 - Lateral Tool Transfer
• T1166 - Setuid and Setgid
• T1591.004 - Identify Roles
• T1498 - Network Denial of Service
• T1546.016 - Installer Packages
• T1134 - Access Token Manipulation
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1220 - XSL Script Processing

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027)
• CVE-2017-0143 (T1027)
• CVE-2014-0322 (T1498)
• CVE-2015-2419 (T1027)
• CVE-2016-0189 (T1027)
• CVE-2015-3043 (T1134)
• CVE-2016-1990 (T1157)
• CVE-2016-1991 (T1051)
• CVE-2015-2852 (T1027)
• CVE-2015-2854 (T1027)
• CVE-2015-2853 (T1027)
• CVE-2016-1287 (T1027)
• CVE-2016-1562 (T1597)
• CVE-2012-0507 (T1027)
• CVE-2013-2465 (T1027)
• CVE-2013-7331 (T1134)
• CVE-2016-4117 (T1027)
• CVE-2025-68645 (T1498)
• CVE-2015-1770 (T1622)
• CVE-2015-2545 (T1597)
• CVE-2017-0199 (T1622)
• CVE-2012-0158 (T1570)
• CVE-2013-3906 (T1027)
• CVE-2014-6352 (T1027)
• CVE-2015-0016 (T1027)
• CVE-2010-3333 (T1027)
• CVE-2010-0188 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1591.004)
• CVE-2015-7755 (T1027)
• CVE-2015-8286 (T1165)
• CVE-2015-8287 (T1165)
• CVE-2015-0932 (T1051)
• CVE-2023-1389 (T1134)
• CVE-2016-2343 (T1027)
• CVE-2016-6532 (T1546.005)
• CVE-2012-4969 (T1498)
• CVE-2010-3081 (T1027)
• CVE-2014-8361 (T1003.007)
• CVE-2010-2883 (T1591.004)
• CVE-2012-6422 (T1027)
• CVE-2012-1856 (T1027)
• CVE-2014-6332 (T1027)
• CVE-2014-4113 (T1570)
• CVE-2015-1701 (T1570)
• CVE-2012-4792 (T1547.013)
• CVE-2014-4322 (T1027)
• CVE-2015-0057 (T1027)
• CVE-2015-2360 (T1570)
• CVE-2014-4148 (T1027)
• CVE-2010-4398 (T1570)
• CVE-2013-2595 (T1027)
• CVE-2015-5897 (T1157)
• CVE-2008-1436 (T1220)
• CVE-2016-1898 (T1051)
• CVE-2016-1897 (T1051)
• CVE-2015-6585 (T1051)
• CVE-2016-9494 (T1027)
• CVE-2016-9496 (T1027)
• CVE-2016-9495 (T1027)
• CVE-2014-1776 (T1498)
• CVE-2012-1876 (T1027)
• CVE-2013-2678 (T1027)
• CVE-2009-3129 (T1027)
• CVE-2025-24893 (T1027)
• CVE-2025-31125 (T1027)
• CVE-2026-20127 (T1498)
• CVE-2015-7645 (T1027)
• CVE-2015-4495 (T1027)
• CVE-2015-5749 (T1027)
• CVE-2015-6034 (T1157)
• CVE-2015-7261 (T1051)
• CVE-2015-6036 (T1051)
• CVE-2015-6022 (T1051)
• CVE-2015-7262 (T1157)
• CVE-2017-16929 (T1027)
• CVE-2014-7247 (T1027)
• CVE-2025-54313 (T1051)
• CVE-2015-2546 (T1027)
• CVE-2015-3785 (T1027)
• CVE-2015-3456 (T1027)
• CVE-2014-6271 (T1591.004)
• CVE-2016-0984 (T1498)
• CVE-2014-0329 (T1027)
• CVE-2017-0263 (T1027)
• CVE-2017-3212 (T1597)
• CVE-2025-55182 (T1498)
• CVE-2014-3153 (T1157)
• CVE-2014-7911 (T1027)
• CVE-2015-3636 (T1498)
• CVE-2013-6282 (T1027)
• CVE-2015-3105 (T1027)
• CVE-2015-0310 (T1027)
• CVE-2014-0556 (T1027)
• CVE-2013-3660 (T1157)
• CVE-2010-1297 (T1591.004)
• CVE-2011-3402 (T1027)
• CVE-2014-6324 (T1220)
• CVE-2013-0634 (T1027)
• CVE-2015-2426 (T1027)
• CVE-2010-0232 (T1027)
• CVE-2014-3393 (T1027)
• CVE-2014-2273 (T1597)
• CVE-2015-2387 (T1027)
• CVE-2012-0611 (T1597)
• CVE-2017-7255 (T1134)
• CVE-2025-34026 (T1027)
• CVE-2025-55183 (T1498)
• CVE-2025-55184 (T1498)
• CVE-2013-2094 (T1027)
• CVE-2015-7808 (T1157)
• CVE-2016-1019 (T1027)
• CVE-2015-3628 (T1027)
• CVE-2012-0056 (T1027)
• CVE-2012-1258 (T1027)
• CVE-2012-4681 (T1027)
• CVE-2015-1761 (T1157)
• CVE-2010-0738 (T1027)
• CVE-2011-1255 (T1157)
• CVE-2017-0001 (T1027)
• CVE-2025-13927 (T1498)
• CVE-2025-13928 (T1027)
• CVE-2026-1102 (T1498)
• CVE-2015-5119 (T1498)
• CVE-2015-5122 (T1134)
• CVE-2015-1427 (T1027)
• CVE-2017-12149 (T1027)
• CVE-2015-3090 (T1027)
• CVE-2010-1553 (T1027)
• CVE-2015-3113 (T1027)
• CVE-2015-2424 (T1027)
• CVE-2015-0097 (T1027)
• CVE-2016-1010 (T1027)
• CVE-2016-1001 (T1027)
• CVE-2016-0998 (T1498)
• CVE-2015-0313 (T1498)
• CVE-2015-0359 (T1134)
• CVE-2015-5130 (T1498)
• CVE-2015-5134 (T1498)
• CVE-2015-5539 (T1498)
• CVE-2015-5557 (T1498)
• CVE-2015-5563 (T1498)
• CVE-2015-5559 (T1498)
• CVE-2015-5540 (T1498)
• CVE-2015-5561 (T1498)
• CVE-2015-5551 (T1498)
• CVE-2015-5564 (T1498)
• CVE-2015-5565 (T1498)
• CVE-2015-5550 (T1498)
• CVE-2015-5566 (T1498)
• CVE-2015-5127 (T1498)
• CVE-2015-5556 (T1498)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2015-0311 (T1027)
• CVE-2012-3213 (T1027)
• CVE-2015-0336 (T1027)
• CVE-2011-3544 (T1027)
• CVE-2014-0497 (T1027)
• CVE-2017-17215 (T1027)
• CVE-2013-0074 (T1027)
• CVE-2014-8439 (T1027)
• CVE-2013-2551 (T1498)
• CVE-2014-0569 (T1027)
• CVE-2014-0515 (T1027)
• CVE-2015-5560 (T1027)
• CVE-2014-9163 (T1027)
• CVE-2012-1723 (T1027)
• CVE-2014-8440 (T1134)
• CVE-2010-0806 (T1547.013)
• CVE-2012-5054 (T1027)
• CVE-2013-0641 (T1591.004)
• CVE-2014-3897 (T1027)
• CVE-2010-2572 (T1027)
• CVE-2013-5990 (T1027)
• CVE-2025-13335 (T1498)
• CVE-2026-0723 (T1027)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る