Evil Corp is the ransomware operation where a payment decision can become a sanctions violation, because the group has been designated by the US Treasury since December 2019. It began with the Dridex banking trojan, moved into targeted ransomware, and after sanctions repeatedly changed ransomware brands and later used an affiliate programme, which Mandiant assesses was intended to hinder attribution and evade sanctions. This profile covers the group's names and aliases, its targeting, the techniques MITRE ATT&CK records for it, its heavy reliance on credentials, and the detections and controls that matter, including what sanctions mean for incident response. It describes the group only and does not name individuals. It is for SOC analysts, incident responders and the legal and finance teams who make ransom decisions, and complements the Ransomware Payments and Sanctions Guide.
Key takeaways
- Attribution decides whether payment is even lawful. OFAC designated Evil Corp under Executive Order 13694 in December 2019, and its 2021 advisory says civil penalties apply on a strict liability basis, so a ransom note bearing a new brand does not remove the risk.
- Brands change, behaviour persists. ATT&CK lists BitPaymer, WastedLocker and Hades ransomware, and Mandiant assesses with high confidence that the related cluster UNC2165 moved to LockBit to blend in with other affiliates.
- Fake browser updates were the signature entry point. ATT&CK records fake Flash and Chrome updates served from compromised legitimate websites; Mandiant describes near-exclusive reliance on FAKEUPDATES (SocGholish) for UNC2165.
- Credentials are harvested at every layer. LSASS dumping, Kerberoasting, the SECURITY registry hive, credentials in files and exported password manager vaults all appear in ATT&CK and Mandiant reporting.
- Purchased VPN access is the other door. ATT&CK records the group buying access to victim VPNs, which makes MFA on remote access and alerting on unusual VPN sessions core controls.
Who they are (names and aliases)
ATT&CK tracks the group as Indrik Spider (G0119) and describes it as a Russia-based cybercriminal group active since at least 2014. The aliases in ATT&CK v20 are Evil Corp, Manatee Tempest (Microsoft), DEV-0243 (an earlier Microsoft name) and UNC2165 (Mandiant). Mandiant assesses UNC2165 as linked to Evil Corp with high confidence, based on shared initial access methods, ransomware code and command and control infrastructure.
| Period | Tooling or event | Source |
|---|---|---|
| From 2014 | Dridex banking trojan (S0384), derived from Bugat (Cridex) source code; Treasury estimated more than $100 million in theft from banks in more than 40 countries | ATT&CK; US Treasury |
| From 2017 | Targeted ransomware with BitPaymer (S0570) | ATT&CK |
| December 2019 | OFAC designates Evil Corp under E.O. 13694, with 17 individuals and seven entities; a US indictment follows the same month | US Treasury; ATT&CK |
| From May 2020 | WastedLocker (S0612) against manufacturing, IT and media sectors | ATT&CK |
| 2020 to 2021 | Hades and further closely related families, a cycle Mandiant reads as difficulty receiving payments after OFAC's October 2020 advisory | ATT&CK; Mandiant |
| 2022 | UNC2165 deploys LockBit as an affiliate | Mandiant |
Because the group has used several brands, consult the Ransomware Family Lineage and Rebrands Guide and the LockBit Threat Actor Profile when a case involves any of these families.
Targeting and motivation
The motive is financial. Dridex targeted online banking credentials for wire fraud. The ransomware phase moved to "big game hunting": large organisations able to pay high ransoms, with encryption of domain-joined systems and, in later operations, data theft before encryption for extortion.
- Opportunistic first stage, selective second stage: fake update infections reach many visitors to compromised websites, and the operators then pick the corporate networks worth a hands-on intrusion.
- Sectors: ATT&CK lists manufacturing, information technology and media among WastedLocker victims. The group is not sector-specific; size and ability to pay matter more.
- Sanctions avoidance as a business driver: Mandiant assesses that moving to a ransomware-as-a-service programme removes development costs and makes the group's operations harder to tell apart from other affiliates, which is precisely the problem for a victim's sanctions screening. See the Ransomware-as-a-Service Business Model Guide.
Tactics and techniques (MITRE ATT&CK)
The mapping below is taken from the G0119 entry in ATT&CK v20 and its cited sources, including Mandiant's UNC2165 reporting. All IDs were checked against v20.
| Tactic | Technique (ATT&CK v20) | Recorded behaviour |
|---|---|---|
| Resource development | T1584.004 Server; T1583 Acquire Infrastructure | Fake updates hosted on compromised legitimate websites; purchased access to victim VPNs |
| Initial access and execution | T1036.005 Match Legitimate Resource Name or Location; T1059.007 JavaScript; T1204.002 Malicious File | Fake Flash Player and Chrome updates; malicious JavaScript and zipped files |
| Initial access | T1078 Valid Accounts | Valid accounts for initial access and lateral movement |
| Command and control | Cobalt Strike (S0154); Empire (S0363) | Commercial and open-source C2 frameworks for hands-on operations |
| Credential access | T1003.001 LSASS Memory; T1558.003 Kerberoasting; T1555.005 Password Managers; T1552.001 Credentials In Files; T1012 Query Registry | Credential dumping, service ticket cracking, password manager exports, file share searches and SECURITY hive copies via a service account |
| Persistence | T1136.001 Local Account | New local accounts added to privileged groups |
| Lateral movement | T1021.001 Remote Desktop Protocol; T1021.004 SSH; T1047 Windows Management Instrumentation | RDP, SSH to storage systems and WMI for remote execution |
| Defence impairment | T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1112 Modify Registry | Antivirus disabled or reconfigured, logs cleared, administrative tools disabled through the registry |
| Deployment | T1484.001 Group Policy Modification | Group Policy Objects used to push scripts across the domain |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Rclone (S1040) or MEGAsync before encryption |
| Impact | T1489 Service Stop; T1486 Data Encrypted for Impact | Security, backup and database services stopped, then encryption of domain-joined systems |
The initial access chain is covered in depth in the SocGholish and Fake Browser Update Malware Guide. ATT&CK notes that SocGholish is operated by Mustard Tempest (G1020), which has sold access to groups including Indrik Spider, so a SocGholish infection is an access broker event before it is an Evil Corp event.
How they abuse identities and credentials
Evil Corp intrusions are credential campaigns with ransomware at the end. Each of the following is recorded in ATT&CK or by Mandiant.
- Bought remote access: purchased VPN access and suspected stolen VPN credentials give a logged-in session with no malware at all. Phishing-resistant MFA and device checks on VPN are the counter. See the VPN and Firewall Log Detection Guide.
- Service accounts as tools: Mandiant describes a service account used to extract the SECURITY registry hive, and Kerberoasting to crack service account passwords. Long, managed passwords (gMSA where possible) and AES-only Kerberos for service accounts make roasting impractical. See the Kerberoasting and AS-REP Roasting Defence Guide and the Service Account Security Guide.
- Password manager vaults: Mandiant reports exports from KeePass and Thycotic Secret Server. A privileged access vault reached with a domain admin session is a single point of total compromise, so vault access must need a separate, strongly authenticated identity. See the Password Manager Vault Breach Response Playbook.
- Credentials in files: searches of file shares for password files and key databases turn poor hygiene into domain access.
- Local admin creation: new local accounts in privileged groups provide fallback access if domain credentials are reset.
- Management consoles: Mandiant notes access to VMware vCenter and antivirus management consoles, which are identity planes in their own right and should not trust ordinary domain admin accounts.
Notable incidents
No live NHI Mgmt Group breach page is attributed to Evil Corp, so the incidents below are the group-level milestones named in official and vendor sources rather than individual victims.
| Event | What happened | Lesson |
|---|---|---|
| Dridex campaigns (from 2014) | Banking credentials harvested from hundreds of banks and financial institutions in more than 40 countries, with over $100 million in theft estimated by Treasury | Credential theft at scale funded the later ransomware operation |
| OFAC designation (December 2019) | Group, operators, linked businesses and financial facilitators designated; US persons generally prohibited from dealings; secondary sanctions risk for foreign facilitators | Victims, insurers and DFIR firms must screen ransom payments |
| WastedLocker operations (from 2020) | Ransomware against large organisations in manufacturing, IT and media | A rebrand weeks after designation shows brand names cannot be used for screening |
| Move to LockBit (2022) | UNC2165 assessed as using an established RaaS to hinder attribution | Intrusion behaviour, not the encryptor, is the evidence for sanctions analysis |
Sanctions and payment decisions
OFAC's updated advisory of 21 September 2021, which superseded the October 2020 advisory, applies to victims and to the companies that facilitate payments, including financial institutions, cyber insurers and DFIR firms. It states that civil penalties can be imposed on a strict liability basis, that licence applications for ransomware payments carry a presumption of denial, and that prompt reporting to law enforcement, full cooperation and meaningful cybersecurity practices are significant mitigating factors. For a suspected Evil Corp case, practical steps are:
- Preserve attribution evidence early: initial access artefacts, C2 infrastructure, tooling and ransom note details, so legal counsel can assess the link to the designated group.
- Screen every party: the threat actor, wallet addresses and any intermediary against OFAC and, where relevant, UK and EU sanctions lists.
- Report and cooperate: notify law enforcement (in the US, the FBI or CISA) as early as possible.
- Plan recovery without payment: assume payment may be unlawful and test the restore path in advance.
The Ransomware Payments and Sanctions Guide covers the regimes in detail. This section summarises published guidance and is not legal advice.
Detection and defence
What to monitor
| Signal | Where to find it | Technique |
|---|---|---|
| Browser downloads of script files named as browser or plugin updates, followed by script host execution | EDR process trees, proxy logs | T1036.005, T1059.007 |
| VPN sessions from new devices, unusual geographies or outside working patterns, especially for dormant accounts | VPN and IdP logs | T1078, T1133 |
| Bursts of Kerberos service ticket requests with RC4 encryption from one account | Domain controller Security log, Event ID 4769 | T1558.003 |
| Process access to LSASS by non-security tools | EDR; Sysmon Event ID 10 | T1003.001 |
| Local accounts created and added to Administrators | Security log Event IDs 4720 and 4732 | T1136.001 |
| Antivirus exclusions added or real-time protection disabled | Defender operational log, EDR tamper alerts | T1685 |
| Security log cleared | Security log Event ID 1102 | T1685.005 |
| New or modified GPOs that run scripts or scheduled tasks | Directory Service Changes, Event ID 5136 | T1484.001 |
| Rclone or MEGAsync execution and large uploads | EDR, proxy, firewall | T1567.002 |
Defences that break the playbook
- Stop fake update execution: block or open script files (.js, .jse, .vbs) in Notepad by default through file association policy, and apply application control to script hosts on user endpoints. Test with a pilot group and keep an exception route for administrators.
- Harden remote access: phishing-resistant MFA on every VPN account, disable dormant accounts, and alert on first-seen devices. See the Secure Remote Access Beyond VPN Guide.
- Protect credential stores: enable LSA protection and Credential Guard, move service accounts to gMSA, and put privileged vaults behind separate admin identities.
- Tier administration: separate accounts for domain, virtualisation, backup and security consoles so one stolen domain admin cannot reach all of them.
- Protect security tools: turn on tamper protection and alert on GPO changes that touch security settings.
- Keep recovery independent: immutable, offline backups with credentials not stored in the domain, tested regularly, so payment is never the only option.
Metrics
- VPN MFA coverage: percentage of VPN accounts using phishing-resistant MFA (target 100%).
- Roastable accounts: number of user-based service accounts with SPNs and RC4 enabled (target falling to zero).
- Script blocking coverage: percentage of endpoints where downloaded scripts cannot run by double click.
- Tamper protection coverage: percentage of endpoints with security tool tamper protection enforced.
- Restore test success: share of critical systems restored within target time in the last test.
Framework mapping
| Defence | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Credential and service account management | PR.AA-01 | IA-5 Authenticator Management |
| MFA for remote access | PR.AA-03 | IA-2 Identification and Authentication |
| Monitoring for credential theft and tampering | DE.CM-03 | SI-4 System Monitoring |
| Incident handling with law enforcement and counsel | RS.MA-01 | IR-4 Incident Handling |
| Immutable backups | PR.DS-11 | CP-9 System Backup |
Practitioner checklist
- Add Evil Corp aliases (Indrik Spider, Manatee Tempest, DEV-0243, UNC2165) and its ransomware families to your threat intelligence watch list.
- Include a sanctions screening step, with legal counsel, in the ransomware response plan before any payment discussion.
- Prevent downloaded script files from running by double click on user endpoints.
- Enforce phishing-resistant MFA on all VPN and remote access accounts and disable dormant ones.
- Remove RC4 and weak passwords from service accounts and alert on Kerberoasting patterns.
- Restrict access to password vaults and privileged consoles to separate, strongly authenticated admin identities.
- Alert on GPO changes, security log clearing and antivirus exclusion changes.
- Monitor for Rclone and MEGAsync and large uploads to cloud storage.
- Test offline backup restores so recovery never depends on payment.
Standards and references
- MITRE ATT&CK: Indrik Spider (G0119)
- US Treasury: Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware
- OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
- Mandiant: To HADES and Back, UNC2165 Shifts to LOCKBIT to Evade Sanctions
- MITRE ATT&CK: WastedLocker (S0612)
- MITRE ATT&CK: SocGholish (S1124)
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Ransomware Payments and Sanctions Guide · Ransomware Groups Guide · SocGholish and Fake Browser Update Malware Guide · LockBit Threat Actor Profile · Kerberoasting and AS-REP Roasting Defence Guide