Indrik Spider

Overview

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.

Naming & attribution

Indrik Spider is tracked under 5 names across the industry. It uses 33 documented ATT&CK techniques — more than 70% of the 174 groups tracked here. Activity attributed since at least 2014.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1136 Create Account — used by 3 of 174 groups
• T1558.003 Kerberoasting — used by 3 of 174 groups
• T1590 Gather Victim Network Information — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Aquatic Panda China — 13 shared techniques (24% overlap)
• Wizard Spider Russia — 18 shared techniques (23% overlap)
• Silence — 11 shared techniques (22% overlap)
• Fox Kitten Iran — 13 shared techniques (21% overlap)
• FIN8 — 12 shared techniques (21% overlap)
• Play — 10 shared techniques (20% overlap)

Capabilities

• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 33 techniques across 13 tactics

Tools & malware (8)

Donut · Mimikatz · Empire · PsExec · Dridex · WastedLocker · BitPaymer · Cobalt Strike

Reporting (3)

• How Microsoft names threat actors — Microsoft
• To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions — Mandiant Intelligence
• INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions — Podlosky, A., Feeley, B