Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp.
In short
Attributed by MITRE ATT&CK to a Russia-based criminal group, which it also lists as Evil Corp. The US Treasury, the US Department of Justice and UK authorities name people behind the Dridex banking malware and later ransomware, and have sanctioned or charged them. Its work is stealing money from banks and extorting companies with ransomware.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Indrik Spider | MITRE ATT&CK G0119 (group name); German BKA wanted notice of March 2023; NCA paper of October 2024[1, 10, 11] |
| Evil Corp | MITRE ATT&CK (Associated Groups); US Treasury of 5 December 2019 and 1 October 2024; UK government and NCA of October 2024[1, 2, 6, 8, 9] |
| Manatee Tempest | MITRE ATT&CK (Associated Groups)[1] |
| DEV-0243 | MITRE ATT&CK (Associated Groups)[1] |
| UNC2165 | MITRE ATT&CK (Associated Groups)[1] |
| Doppel Spider | German BKA wanted notice of March 2023, which says Indrik Spider is also known as Doppel Spider[11] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 4.1, last modified 31 July 2026
Describes Indrik Spider as a Russia-based cybercriminal group active since at least 2014. Lists Evil Corp, Manatee Tempest, DEV-0243 and UNC2165 as associated groups. Says the group changed tactics after the 2019 US sanctions and indictment. It states no link to a government.[1]
US Treasury (OFAC) 5 December 2019
Designated Evil Corp, a Russia-based cybercriminal organization it holds responsible for developing and distributing Dridex, plus 17 individuals and seven entities. Said it is run by people based in Moscow and led by Maksim Yakubets.[2]
US Treasury (OFAC) 5 December 2019
Stated that as of 2017 Yakubets was working for the Russian FSB, that as of April 2018 he was getting a license from the FSB to work with Russian classified information, and that as of 2017 he was tasked with projects for the Russian state. This is Treasury's statement.[2]
US Department of Justice 5 December 2019
Unsealed a 10-count indictment against Yakubets and Turashev over the Bugat (Dridex) malware, alleging Yakubets led the group and Turashev handled administration. The release does not use the name Evil Corp. These are allegations.[3]
UK National Crime Agency 5 December 2019
Assessed that Yakubets and Evil Corp, the group he controls, represent the most significant cyber crime threat to the UK.[4]
German BKA March 2023
Wanted notice for Igor Turashev. Says the cyberattacks in question can be attributed to the group Indrik Spider, also known as Doppel Spider, and ties it to BitPaymer and DoppelPaymer. It names no state link.[11]
US Treasury (OFAC) 1 October 2024
Designated seven individuals and two entities as associated with Evil Corp. Said Eduard Benderskiy, Yakubets's father-in-law and a former FSB officer, was a key enabler of Evil Corp's relationship with the Russian state. Also said he has no official position in the Russian government.[6]
US Department of Justice 1 October 2024
Unsealed an indictment charging Aleksandr Ryzhenkov with using BitPaymer ransomware against victims in Texas and across the US. The release does not use the name Evil Corp. An indictment is only an allegation.[7]
UK government (FCDO) 1 October 2024
Sanctioned 16 people connected to Evil Corp. Stated that Yakubets cultivated strong ties between Evil Corp and the Russian state, developing relationships with the FSB and Russian military intelligence (GRU).[8]
UK National Crime Agency 2 October 2024 (date on the NCA page)
Stated that Benderskiy was a key enabler of the group's relationship with the Russian Intelligence Services, who before 2019 tasked Evil Corp with cyber attacks and espionage against NATO allies.[9]
UK National Crime Agency, with support from the FBI and Australian Federal Police October 2024
Published "Evil Corp: Behind the Screens". It says Evil Corp (also known as Indrik Spider) originated from Russia and that Yakubets led liaison with the intelligence services.[9, 10]
Sources differ on names. MITRE uses Indrik Spider as the group name and lists Evil Corp as an associated group, while the US Treasury, the UK government and the NCA use only Evil Corp, the German BKA uses Indrik Spider and Doppel Spider, and the US Department of Justice releases of 2019 and 2024 use neither name. Only the NCA paper puts the two names together ("Evil Corp (also known as Indrik Spider)"). Sources also differ on software: MITRE lists BitPaymer, WastedLocker and Hades for Indrik Spider and the BKA ties the same name to BitPaymer and DoppelPaymer, but the NCA paper says that after a split in 2019 Turashev led DoppelPaymer while the remaining Evil Corp group developed WastedLocker.
On state links the wording differs: the US Treasury (2019) says Yakubets worked for the FSB, the UK government (2024) says he developed relationships with the FSB and GRU, the NCA paper (2024) adds the SVR, and the US Treasury (2024) says Benderskiy holds no official post; MITRE and the Department of Justice releases state no such link. MITRE says WastedLocker has been used since at least May 2020 and the NCA paper says mid-2020.
Each entry is attributed to the group by the sources cited.
The US Department of Justice says a complaint unsealed in 2019 alleges Yakubets took part in a Zeus malware bank fraud conspiracy beginning in May 2009. It is an allegation.[3]
The US Department of Homeland Security released an alert on the Dridex botnet with the FBI and the Department of Justice.[5]
The US Treasury says that as of 2016 Evil Corp had taken banking logins from about 300 banks and financial institutions in over 40 countries.[2]
The US Department of Justice says the Bugat attacks in the indictment occurred as recently as 19 March 2019.[3]
The NCA paper says a split between Yakubets and Turashev began in mid-2019, after which Turashev led DoppelPaymer and the rest of the group began work on WastedLocker.[10]
The NCA paper says some remaining members and affiliates have deployed other ransomware strains since 2022, including LockBit.[10]
The BKA publishes a wanted notice for Turashev over attacks on German companies.[11]
The NCA paper says a NCA-led takedown disrupted LockBit under Operation Cronos.[10]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| August 2015 | UK NCA and US FBI | ArrestA joint investigation led to the arrest of Andrey Ghinkul, a Dridex distributor known as Smilex.[4] |
| 2015 | UK NCA and US FBI | Botnet disruptionAction briefly disabled the Dridex botnet.[4] |
| October 2015 | US Department of Justice | IndictmentIndicted Andrey Ghinkul for spreading the Dridex malware, per the US Treasury.[2] |
| 13 October 2015 | US Department of Homeland Security with the FBI and Department of Justice | Technical alert TA15-286ADescribed the Dridex botnet and advised users to change passwords and keep software up to date.[5] |
| 5 December 2019 | US Treasury (OFAC) | SanctionsDesignated Evil Corp and its members and facilitators under Executive Order 13694.[2] |
| 5 December 2019 | US Department of Justice | IndictmentUnsealed a 10-count indictment against Yakubets and Turashev over Bugat (Dridex) malware, plus a Zeus complaint against Yakubets.[3] |
| 5 December 2019 | US Department of State with the FBI | RewardUp to 5 million dollars for information leading to the arrest or conviction of Yakubets.[3] |
| 5 December 2019 | UK NCA | Public statementSaid it supported the US action and assessed Evil Corp as the most significant cyber crime threat to the UK.[4] |
| 21 September 2021 | US Treasury (OFAC) | AdvisoryReminded companies that ransomware payments can risk breaching sanctions, citing the Evil Corp designation.[12] |
| March 2023 | German BKA | Wanted noticePublic search for Igor Turashev, suspected of complicity in attempted extortion and computer sabotage.[11] |
| 1 October 2024 | US Treasury (OFAC) | SanctionsDesignated seven individuals and two entities, with the UK and Australia acting at the same time.[6] |
| 1 October 2024 | US Department of Justice | IndictmentUnsealed an indictment charging Aleksandr Ryzhenkov over BitPaymer attacks.[7] |
| 1 October 2024 | UK government (FCDO) | SanctionsSanctioned 16 people with asset freezes and travel bans.[8] |
| 1 October 2024 | Australia | SanctionsThe US Treasury says Australia designated three people. The Australian government page could not be opened.[6] |
| October 2024 | UK NCA with support from the FBI and Australian Federal Police | Public reportPublished "Evil Corp: Behind the Screens", a history of the group and its links to the Russian state.[8, 9, 10] |
| 19 November 2025 | UK government | Sanctions on a hosting providerTargeted the leader of Media Land, a hosting provider, who the UK says has worked with groups including Evil Corp, LockBit and Black Basta.[13] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing T1566
The US Treasury and CISA say Dridex is spread mainly by phishing email, and the US Department of Justice (2024) lists phishing among the entry methods.[2, 5, 7]
Valid Accounts T1078
MITRE says the group used valid accounts for initial access and lateral movement and kept access through VPN infrastructure.[1]
Dridex Banking malware
Steals online banking logins and is spread by phishing email. MITRE says it first appeared in 2014 and was built from the Bugat code.[1, 2, 5, 16]
BitPaymer Ransomware
MITRE says it was first seen in August 2017 aimed at UK hospitals and is often delivered via Dridex. The US charged its use against US victims in 2024.[7, 14]
WastedLocker Ransomware
MITRE attributes it to Indrik Spider and says it has been used since at least May 2020.[1, 15]
Hades Ransomware
Named by MITRE and the NCA among the ransomware strains linked to the group.[1, 9]
Dridex 2.0 Banking malware
The US Treasury says Ryzhenkov and others developed it in 2020, after the 2019 sanctions.[6]
SocGholish Initial access tool
The NCA paper says the group switched to it in 2020 and continued to use it through 2024.[10]
Cobalt Strike Remote access tool
MITRE says the group used it to dump credentials and to clear log files.[1, 17]
Mimikatz Credential dumping tool
Listed by MITRE among the software used by the group.[1]
PsExec Administration tool
MITRE says the group used it to stop services before ransomware and to run a ransomware script.[1]
Empire Attack framework
MITRE says the group used PowerShell Empire to run malware.[1]
PhoenixLocker, PayloadBIN and Macaw Ransomware
Named by the NCA among the strains developed after 2019.[9]
MITRE says data was copied out with Rclone or MEGASync before encryption. Limit and monitor web-based storage use.
Counters T1567.002
The NCSC advises that files are backed up, and MITRE lists data backup as a mitigation for ransomware.
Counters T1486
The US Treasury says paying ransom can risk breaching sanctions and strongly discourages paying. Seek advice first.
Counters T1486
See which ransomware groups and leak-site posts name your company or suppliers, relevant because governments describe this group's move from banking malware to ransomware.
Watch for leaked or sold company logins, since MITRE says the group bought VPN access and used valid accounts.
Find look-alike domains and fake update pages aimed at your staff or customers, since governments say Dridex spreads by phishing and MITRE lists fake updates.
See which VPN and remote access services face the internet so you can protect or close them.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
MITRE ATT&CK describes Indrik Spider as a Russia-based criminal group active since at least 2014 and lists Evil Corp as an associated name. The US Treasury, UK government and NCA use the name Evil Corp, the German BKA uses Indrik Spider, and the NCA paper says "Evil Corp (also known as Indrik Spider)". Sources differ on some of the software, see "Where sources differ".
The US charged Maksim Yakubets and Igor Turashev in December 2019 and Aleksandr Ryzhenkov in October 2024. The US sanctioned Evil Corp members in December 2019, and the US, UK and Australia sanctioned more in October 2024. An indictment is only an allegation.
Only as each body states it. The US Treasury (5 December 2019) said Yakubets was working for the FSB as of 2017. The UK government (1 October 2024) said he developed relationships with the FSB and GRU. The NCA (October 2024) said Russian intelligence services tasked Evil Corp before 2019. MITRE and the US Department of Justice releases state no such link.
Governments and MITRE name the Dridex banking malware, then ransomware including BitPaymer, WastedLocker and Hades. The UK government also says affiliated actors used LockBit ransomware.
The US Treasury and CISA say Dridex spreads by phishing email. MITRE adds fake updates on hacked websites, bought VPN access and stolen logins.
Filter phishing email, keep software updated, protect remote logins with multi-factor authentication, keep offline backups, and check sanctions rules before any ransom payment.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.