Threat Actor: Evil Corp
Evil Corp is classified as an advanced Organized Cybercrime Syndicate originating primarily from Russia (Maksim Yakubets / Igor Turashev). Driven by operational objectives spanning automated banking theft, enterprise infiltration & high-yield ransomware, this threat entity has maintained an active footprint from 2014 - Present. In enterprise telemetry and malware repository classification, Evil Corp has been corroborated across 3 distinct malware families with over 72 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | Indrik Spider, Dridex Gang, Locky Syndicate, Gold Drake |
|---|---|
| Targeted Sectors | Banking Institutions, Corporate Accounting Departments, School Districts, Industrial Conglomerates |
| Primary Motivations | Automated Banking Theft, Enterprise Infiltration & High-Yield Ransomware |
| Dominant Payload Categories | Banking Trojan · Ransomware · Spam Bot |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0119/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Evil Corp:
T1071.001— weaponized across 3 catalog payload(s)T1566.001— weaponized across 2 catalog payload(s)T1568.002— weaponized across 2 catalog payload(s)T1185— weaponized across 1 catalog payload(s)T1056.004— weaponized across 1 catalog payload(s)T1055.012— weaponized across 1 catalog payload(s)T1021.002— weaponized across 1 catalog payload(s)T1547.001— weaponized across 1 catalog payload(s)T1001.003— weaponized across 1 catalog payload(s)T1105— weaponized across 1 catalog payload(s)T1486— weaponized across 1 catalog payload(s)T1490— weaponized across 1 catalog payload(s)T1027— weaponized across 1 catalog payload(s)T1014— weaponized across 1 catalog payload(s)T1562.001— weaponized across 1 catalog payload(s)T1059.003— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Evil Corp has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2016-0189 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0199 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-11882 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (3 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Evil Corp:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| dridex | Banking Trojan | 59 | Dridex (also known as Bugat v5, Cridex, and Dridex Banking Trojan) is an infamous, highly sophisticated banking trojan and modular malware framework first docum... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Evil Corp operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Evil Corp requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).