Actors/Cybercrime/Europe

Evil Corp

G0119CRIMERU · Russia

AKA DEV-0243 · TA505 (overlap) · Dridex Gang

CrowdStrike: INDRIK SPIDERMandiant: FIN11Microsoft: Manatee TempestMITRE: G0119Proofpoint: TA505Secureworks: GOLD DRAKE

Russian-speaking cybercriminal syndicate behind Dridex banking malware and ransomware.

Targets11

Sectors17

Threat types2

GIRs covered0/480

Active since2007

Also tracked as

6 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

INDRIK SPIDER

Mandiant

FIN11

Microsoft

Manatee Tempest

MITRE

G0119

Proofpoint

TA505

Secureworks

GOLD DRAKE

UNATTRIBUTED ALIASESDEV-0243TA505 (overlap)Dridex Gang

Victimology

Geographic footprint · 11 countries

origin · Russiatargeted countries · 11

EUROPE · 7

Austria · Switzerland · Germany · Spain · France · United Kingdom · Italy

OCEANIA · 2

Australia · New Zealand

AMERICAS · 2

Canada · United States

Sectors targeted

17 of 40

Government100 actors Aviation22 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Telecom72 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Real Estate10 actors Hospitality33 actors Consulting / Professional Services35 actors Consumer Goods / Electronics20 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial FraudRAN · Ransomware

MITRE ATT&CK · 25 techniques

Reconnaissance · 1

T1590Gather Victim Network Information

Resource Development · 1

T1583Acquire Infrastructure

Execution · 4

T1047Windows Management Instrumentation

Persistence · 1

T1136Create Account

Credential Access · 4

T1003.001LSASS Memory

Discovery · 3

T1007System Service Discovery T1012Query Registry

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1021.004SSH

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Impact · 2

T1486Data Encrypted for Impact

Command And Control · 1

T1105Ingress Tool Transfer

Defense Impairment · 2

T1112Modify Registry

Stealth · 3

T1036.005Match Legitimate Resource Name or Location T1078Valid Accounts

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer25 techniques · layer format 4.5

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.007JavaScript

T1552.001

Credentials In Files

T1555.005Password Managers

T1558.003Kerberoasting

T1018

Remote System Discovery

T1489

Service Stop

T1685

Disable or Modify Tools

T1078.002

Domain Accounts