Manatee Tempest is an alternate name for the group known as Indrik Spider

---

Manatee Tempest is an advanced persistent threat (APT) that has been active since at least 2014 and continues to target organizations in various industries, including government agencies, defense contractors, and financial institutions. The group's primary objective appears to be stealing sensitive information such as confidential documents, emails, and passwords for further exploitation or sale on the dark web. Manatee Tempest has been linked to several high-profile breaches of major organizations in recent years, including the US Department of Labor and the French defense contractor Thales Group. The group is known for its sophisticated tactics such as spear phishing emails with malicious attachments or links that lead to compromised websites where victims are tricked into downloading a Trojan horse program that gives Manatee Tempest access to their systems and sensitive data.

Techniques, tactics and practices:

Manatee Tempest is a highly sophisticated threat actor that employs various techniques to achieve its objectives. Some of their most common tactics include spear phishing emails with malicious attachments or links, compromising legitimate websites and tricking victims into downloading Trojan horse programs, exploiting vulnerabilities in software and operating systems, using stolen credentials for lateral movement within networks, conducting extensive reconnaissance on target organizations to identify weaknesses and potential entry points. They also use various tools such as PowerShell scripts, custom malware families like ManateeRAT or ManateeGPT, and encryption techniques to hide their activities from detection by security systems. Overall, the group's advanced persistent nature allows them to maintain a long-term presence within target networks while evading detection for extended periods of time.