Evil Corp, also known as UNC2165, GOLD DRAKE, and Indrik Spider, is a Russia-based cybercriminal syndicate that has operated since at least 2009. The group is led by Maksim Viktorovich Yakubets and is notorious for its development and deployment of the Dridex banking trojan, as well as a series of advanced ransomware strains including BitPaymer, WastedLocker, Hades, PhoenixLocker, and MacawLocker.
Evil Corp has been responsible for infecting computers and harvesting banking credentials from hundreds of financial institutions across more than 40 countries, resulting in at least $100 million in theft and hundreds of millions of dollars in global damages. Their operations have targeted a wide range of sectors, including finance, healthcare, government, transportation, and education, with a particular focus on U.S. and U.K. institutions