Actors/Cybercrime/Europe

Evil Corp

CRIMERU · Russia

AKA DEV-0243 · TA505 (overlap)

CrowdStrike: INDRIK SPIDERMicrosoft: Manatee TempestSecureworks: GOLD DRAKE

Russian-speaking cybercriminal syndicate behind Dridex banking malware and ransomware.

Targets11

Sectors17

Threat types2

GIRs covered0/480

Active since2007

Victimology

Geographic footprint · 11 countries

origin · Russiatargeted countries · 11

EUROPE · 7

Austria · Switzerland · Germany · Spain · France · United Kingdom · Italy

OCEANIA · 2

Australia · New Zealand

AMERICAS · 2

Canada · United States

Sectors targeted

17 of 40

Government83 actors Aviation19 actors Financial Services61 actors Cryptocurrency17 actors Healthcare38 actors Telecom57 actors Retail & Hospitality25 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Manufacturing (man)40 actors Media & Journalism41 actors Real Estate7 actors Hospitality26 actors Consulting / Professional Services26 actors Consumer Goods / Electronics16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial FraudRAN · Ransomware

MITRE ATT&CK · 25 techniques

Reconnaissance · 1

T1590Gather Victim Network Information

Resource Development · 1

T1583Acquire Infrastructure

Execution · 4

T1047Windows Management Instrumentation

Persistence · 1

T1136Create Account

Credential Access · 4

T1003.001LSASS Memory

Discovery · 3

T1007System Service Discovery T1012Query Registry

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1021.004SSH

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Impact · 2

T1486Data Encrypted for Impact

Command And Control · 1

T1105Ingress Tool Transfer

Defense Impairment · 2

T1112Modify Registry

Stealth · 3

T1036.005Match Legitimate Resource Name or Location T1078Valid Accounts

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.007JavaScript

T1552.001

Credentials In Files

T1555.005Password Managers

T1558.003Kerberoasting

T1018

Remote System Discovery

T1489

Service Stop

T1685

Disable or Modify Tools

T1078.002

Domain Accounts