DarkVishnya - G0105

Created: 2020-05-15T13:07:26.651Z

Modified: 2021-10-12T22:10:04.107Z

Contributors:

Aliases

DarkVishnya

Description

DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.(Citation: Securelist DarkVishnya Dec 2018)

Techniques Used

DarkVishnya has obtained and used tools such as

Impacket,

Winexe, and

PsExec.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

DarkVishnya performed port scanning to obtain the list of active services.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

DarkVishnya used brute-force attack to obtain login data.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|

DarkVishnya used network sniffing to obtain login data. (Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

DarkVishnya used DameWare Mini Remote Control for lateral movement.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

DarkVishnya used PowerShell to create shellcode loaders.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|