DarkVishnya (G0105) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

About DarkVishnya

DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.

View MITRE record ↗

Techniques by Tactic (10)

Resource Development

T1588.002 Tool

Initial Access

T1200 Hardware Additions

Execution

T1059.001 PowerShell

Persistence

T1543.003 Windows Service

Privilege Escalation

T1543.003 Windows Service

Credential Access

T1040 Network SniffingT1110 Brute Force

Discovery

T1040 Network SniffingT1046 Network Service DiscoveryT1135 Network Share Discovery

Command & Control

T1219 Remote Access ToolsT1571 Non-Standard Port

Toolsets (2)

🔧

PsExec S0029

Tool · Windows

🔧

Winexe S0191

Tool

References & Reports (1)

Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.

↑