Evil_Corp__2024__Evil_Corp_-_Behind_the_Screens.pdf

Evil Corp (Indrik Spider) is a long-running, Russia-based organised cybercrime group responsible for prolific banking malware and multiple ransomware families (Dridex, BitPaymer, DoppelPaymer, WastedLocker, Hades, PhoenixLocker, PayloadBIN, Macaw) that have extorted roughly $300M from victims across healthcare, government and critical infrastructure; the group is highly organised and sophisticated, has been linked to Russian intelligence activities, adapted tactics after 2019 sanctions and indictments, and remained active through 2024 including affiliations with other ransomware operators such as LockBit.