Threat actor
Evil Corp
Russia
Tracked by CyberSIXT since 19 Jun
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 4
One article so far, 19 Jun. A pattern appears once more outlets cover Evil Corp.
Names and sources
- Evil Corp
- Named by CyberSIXT coverage
- Evil Corp
- Named by Malpedia · evil_corp
- GOLD DRAKE
- Named by Malpedia · evil_corp
- DEV-0243
- Named by Microsoft · Manatee Tempest
- INDRIK SPIDER
- Named by Microsoft · Manatee Tempest
- Manatee Tempest
- Named by Microsoft · Manatee Tempest
- Evil Corp
- Named by MISP Galaxy · c30fbdc8-b66d-4242-a02a-e01946bc86d8
- GOLD DRAKE
- Named by MISP Galaxy · c30fbdc8-b66d-4242-a02a-e01946bc86d8
All 14 names
- DEV-0243
- Named by MITRE ATT&CK® · G0119
- Evil Corp
- Named by MITRE ATT&CK® · G0119
- Indrik Spider
- Named by MITRE ATT&CK® · G0119
- Manatee Tempest
- Named by MITRE ATT&CK® · G0119
- UNC2165
- Named by MITRE ATT&CK® · G0119
- c30fbdc8-b66d-4242-a02a-e01946bc86d8
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Manatee Tempest)
- origin
- Russia (Microsoft · Manatee Tempest)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0119) PsExec (MITRE ATT&CK® · G0119) Cobalt Strike (MITRE ATT&CK® · G0119) Empire (MITRE ATT&CK® · G0119) Dridex (MITRE ATT&CK® · G0119) BitPaymer (MITRE ATT&CK® · G0119) WastedLocker (MITRE ATT&CK® · G0119) Donut (MITRE ATT&CK® · G0119) Dridex (Malpedia · evil_corp) PayloadBIN (Malpedia · evil_corp)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0119
Execution
Stealth
- T1036.005
- Match Legitimate Resource Name or Location
Credential Access
- T1003.001
- LSASS Memory
Collection
- T1074.001
- Local Data Staging
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Dutch Police Lead Global Takedown of SocGholish Malware BotnetInfosecurity · first in our coverage