Ransom Ledger

Evil Corp

Also known as Indrik Spider

Built the Dridex banking malware, then a string of ransomware brands, including the Phoenix Locker strain researchers tie to the CNA payment. The US sanctioned it in 2019 and its members again in October 2024.

What it is
Financially motivated group
Based
Russia
Active
2014–
Status
Sanctioned

On the record

  1. Oct 2024 · BleepingComputer

    The US, UK and Australia sanction more Evil Corp members; BitPaymer charges are unsealed

  2. May 2021 · Engadget

    CNA Financial reportedly paid $40 million to end a March attack

In the ledger

$40 million paid in the one payment listed

  • Mar 2021CNA Financial paid $40 million. Reported.