Indrik Spider

Indrik Spider is a notable threat actor known for its cybercriminal activities, particularly in the realm of ransomware. In July 2017, the group entered the targeted ransomware sphere with BitPaymer, using file-sharing platforms to distribute the BitPaymer decryptor. This shift in operations saw Indrik Spider utilize BitPaymer ransomware as a principal tool, netting approximately $1.5M USD within the first 15 months of their ransomware operations. Alongside this, the group operated Dridex malware, containing modules that could collect information from infected hosts, despite the ransomware itself not having this functionality. Indrik Spider's adaptability and resilience have been evident in their continuous advancements in campaigns, the implementation of new tools, and the adoption of third-party products and services. Despite sanctions and indictments against the group and its members, Indrik Spider has shown significant resources and operational resilience, continuing to diversify its strategies. The group's shift towards selective targeting of organizations for high ransomware payouts marked a new focus on targeted, low-volume, high-return criminal activity, referred to as big game hunting. In a further evolution of tactics, Indrik Spider moved away from using email communication and the possibility of exfiltrating data from victims to elicit payments. CrowdStrike Intelligence identified Hades ransomware as Indrik Spider’s successor to WastedLocker based on significant code overlap. However, Hades underwent minor modifications, removing features characteristic of Indrik Spider’s previous ransomware families — WastedLocker and BitPaymer. Falcon Intelligence predicts that Indrik Spider will continue to operate both Dridex and BitPaymer, with the two monetization strategies complementing each other.