AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0119 · 33 ATT&CK techniques · 0 correlated reports

Indrik Spider

Aliases: DEV-0243, Evil Corp, Indrik Spider, Manatee Tempest, UNC2165

[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Open interactive actor investigation

ATT&CK techniques

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
Donut tool reference — Explicit actor uses software relationship in pinned ATT&CK
T1003.001 LSASS Memory simulation — Exact active technique ID
T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1007 System Service Discovery simulation — Exact active technique ID
T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
T1012 Query Registry simulation — Exact active technique ID
T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
T1018 Remote System Discovery simulation — Exact active technique ID
T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.004 SSH simulation — Exact active technique ID
T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1047 Windows Management Instrumentation simulation — Exact active technique ID
T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.001 PowerShell simulation — Exact active technique ID
T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.003 Windows Command Shell simulation — Exact active technique ID
T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.007 JavaScript simulation — Exact active technique ID
T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
T1074.001 Local Data Staging simulation — Exact active technique ID
T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1078 Valid Accounts simulation — Exact active technique ID
T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
T1078.002 Domain Accounts simulation — Exact active technique ID
T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1105 Ingress Tool Transfer simulation — Exact active technique ID
T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
T1112 Modify Registry simulation — Exact active technique ID
T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
T1136 Create Account simulation — Exact active technique ID
T1136 detection rules — Exact active technique ID; not actor-specific detector coverage
T1136.001 Local Account simulation — Exact active technique ID
T1136.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1204.002 Malicious File simulation — Exact active technique ID
T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1484.001 Group Policy Modification simulation — Exact active technique ID
T1484.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1486 Data Encrypted for Impact simulation — Exact active technique ID
T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
T1489 Service Stop simulation — Exact active technique ID
T1489 detection rules — Exact active technique ID; not actor-specific detector coverage
T1552.001 Credentials In Files simulation — Exact active technique ID
T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1555.005 Password Managers simulation — Exact active technique ID
T1555.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1558.003 Kerberoasting simulation — Exact active technique ID
T1558.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1583 Acquire Infrastructure simulation — Exact active technique ID
T1583 detection rules — Exact active technique ID; not actor-specific detector coverage
T1584.004 Server simulation — Exact active technique ID
T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1585.002 Email Accounts simulation — Exact active technique ID
T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1587.001 Malware simulation — Exact active technique ID
T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1590 Gather Victim Network Information simulation — Exact active technique ID
T1590 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685 Disable or Modify Tools simulation — Exact active technique ID
T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-id Module 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-id Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-id Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-id Module 5 — Threat hunting
Blue Team & Defensive Security · explicit-name Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-name Mobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-name Module 6 — Active Directory and identity attack paths
Red Team & Offensive Security · explicit-name Module 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-name Module 4 — Web applications and APIs
Red Team & Offensive Security · explicit-name Module 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · explicit-name Module 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name