{
  "id": "indrik-spider",
  "name": "Indrik Spider",
  "aliases": [
    "Evil Corp",
    "Manatee Tempest",
    "DEV-0243",
    "UNC2165"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russia-based cybercriminal group",
      "src": [
        "mitre-g0119"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0119"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0119",
      "src": [
        "mitre-g0119"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 33,
      "src": [
        "mitre-g0119"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BitPaymer, Cobalt Strike, Donut, Dridex, Empire, Mimikatz, PsExec, WastedLocker",
      "src": [
        "mitre-g0119"
      ],
      "conf": "high",
      "note": "8 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0119)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/indrik-spider.html",
  "sources": {
    "mitre-g0119": {
      "title": "Indrik Spider, Group G0119",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0119/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}