APT ATLAS

Atlas Actors147 Names508 Sectors40 Requirements480

⌘K

Atlas Actors147 Names508 Sectors40 Requirements480

UNC2165 (aka Evil Corp, Dridex Group) · APT Atlas

Actors/Cybercrime/Europe

UNC2165

CRIMERU · Russia

AKA Evil Corp · Dridex Group · DoppelPaymer · BitPaymer · Manatee Tempest

Microsoft: Manatee TempestCrowdStrike: INDRIK SPIDERSecureworks: GOLD DRAKE

Targets19

Sectors17

Threat types1

GIRs covered0/480

Active since—

QUICK FACTS

TypeCybercrime

OriginRussia

First seen—

Type (verbatim)eCrime

GIR coverage0/480

TTPs0

Targets19

Sectors17

Last reviewed2026-07-29

Also tracked as

4 vendor names · 4 other aliases

Open Rosetta Stone

CrowdStrike

INDRIK SPIDER

Mandiant

UNC2165

Microsoft

Manatee Tempest

Secureworks

GOLD DRAKE

UNATTRIBUTED ALIASESEvil CorpDridex GroupDoppelPaymerBitPaymer

Victimology

Geographic footprint · 19 countries

origin · Russiatargeted countries · 19

ASIA · 2

United Arab Emirates · Hong Kong

EUROPE · 11

Austria · Switzerland · Germany · Denmark · Spain · France · United Kingdom · Ireland · Italy · Luxembourg · Sweden

OCEANIA · 2

Australia · New Zealand

AMERICAS · 3

Canada · Mexico · United States

AFRICA · 1

South Africa

Sectors targeted

17 of 40

Government100 actors Aviation22 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Telecom72 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Real Estate10 actors Hospitality33 actors Consulting / Professional Services35 actors Consumer Goods / Electronics20 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial Fraud

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type

Scattered Spidercybercrime

United States · 3 targets · since 2022

APT44nation-state

Russia · 25 targets · since 2009

FIN10cybercrime

unattributed · 1 targets · since 2013

FIN2cybercrime

unattributed · 0 targets · since —

FIN6cybercrime

Russia · 15 targets · since 2014

UNC1543cybercrime

unattributed · 22 targets · since —