{"actor":{"id":"evil-corp","name":"Evil Corp","aliases":["Evil Corp","DEV-0243","TA505 (overlap)","Dridex Gang"],"vendor_names":{"crowdstrike":"INDRIK SPIDER","mandiant":"FIN11","microsoft":"Manatee Tempest","mitre":"G0119","proofpoint":"TA505","secureworks":"GOLD DRAKE"},"mitre_gid":"G0119","type":"cybercrime","type_verbatim":"eCrime","secondary_types":[],"origin":"RU","origins":["RU"],"targets":["AT","AU","CA","CH","DE","ES","FR","GB","IT","NZ","US"],"target_regions":[],"sectors":["avi","consulting-professional-services","consumer-goods-electronics","cryptocurrency","edu","energy-utilities","fin","gov","hea","hospitality","manufacturing-man","med","ngo","oil-and-gas","real-estate","ret","tel"],"threat_types":["fin","ran"],"mitre_techniques":["T1003.001","T1007","T1012","T1018","T1021.001","T1021.004","T1036.005","T1047","T1059.001","T1059.003","T1059.007","T1078","T1078.002","T1105","T1112","T1136","T1486","T1489","T1552.001","T1555.005","T1558.003","T1567.002","T1583","T1590","T1685"],"gir_codes":[],"active_since":2007,"brief":"Russian-speaking cybercriminal syndicate behind Dridex banking malware and ransomware.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:21.3043+00:00","updated_at":"2026-07-29T07:05:57.519+00:00","url":"https://aptatlas.net/actors/evil-corp"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/evil-corp/stix","navigator":"https://aptatlas.net/api/v1/actors/evil-corp/navigator"}}