Evil Corp
View MITRE Group Page ↗Key Facts
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G0095 (Evil Corp).
- Linked to 6 primary court prosecution record(s) with $762.8 million documented loss.
- Identified 2 individually charged operative(s) and 4 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1566.001 Spearphishing Attachment | 1 incidents |
| T1555 Credentials from Password Stores | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1055 Process Injection | 1 incidents |
| T1547.001 Registry Run Keys / Startup Folder | 1 incidents |
| T1053.005 Scheduled Task | 1 incidents |
| T1102 Web Service: Dead Drop Resolver | 1 incidents |
| T1090 Proxy | 1 incidents |
Prosecution Cases Attributed to Evil Corp
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
U.S. v. Evgeniy Mikhailovich Bogachev (GameOver Zeus & CryptoLocker)
Federal indictment of Russian syndicate leader Evgeniy Bogachev for operating GameOver Zeus, a peer-to-peer banking trojan, and CryptoLocker, the first mass-market cryptoviral ransomware, stealing over $100 million with an unprecedented $3 million FBI Rewards for Justice bounty.
U.S. v. Maxim Senakh (Ebury Linux SSH Rootkit & Botnet)
Russian national arrested in Finland, extradited to the United States, and sentenced to 46 months imprisonment in federal court for operating the Ebury botnet, which infected over 25,000 Linux enterprise web servers with a stealth OpenSSH backdoor to harvest system credentials and divert web traffic.
U.S. v. Mark Vartanyan (Citadel Banking Trojan Distribution)
Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.
U.S. v. Aleksandr Zhukov (Methbot Digital Ad Fraud Scheme)
Russian national and self-styled 'King of Fraud' Aleksandr Zhukov convicted after federal trial in Brooklyn and sentenced to 10 years in prison for running Methbot, a massive botnet and server farm that spoofed billions of digital video ad impressions, looting $36 million from American digital advertising networks.
U.S. v. Danil Potekhin & Dmitrii Karasavidi (Exchange Phishing)
Southern District of New York criminal indictment and OFAC sanctions targeting Russian operators of a sophisticated mass phishing campaign that spoofed web domains of major cryptocurrency exchanges (Poloniex, Binance, Bittrex) to steal credentials and 2FA tokens, looting $16.8 million in digital assets.
Indicted Operatives & Dispositions (2)
Leader of Evil Corp cybercrime syndicate. Indicted in W.D. Pa. and sanctioned by OFAC.
Chief administrator and technical coordinator of Evil Corp's Dridex operations.
Treasury OFAC Sanctions Actions
Financial facilitator and confederate of Evil Corp designated in joint US-UK enforcement action.
Official Treasury Press Release ↗State Department offers reward of up to $5,000,000 for information leading to the arrest or conviction of Maksim Yakubets for banking fraud and cyber extortion.
Official Treasury Press Release ↗Leader of Evil Corp cybercriminal syndicate responsible for Dridex banking trojan and multimillion-dollar ransomware extortions.
Official Treasury Press Release ↗Russian cybercrime organization that extorted over $100 million from financial institutions and healthcare providers.
Official Treasury Press Release ↗Documented TTP Signature for Evil Corp
Test Controls in Stack Audit →Adversaries send spearphishing emails with malicious attachments to gain initial access to victim systems.
Adversaries search local browser credential databases and keyrings for cached web passwords.
Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
Adversaries inject malicious code into processes to evade process-based defenses and elevate privileges.
Adversaries add program references to Windows registry run keys to execute malware on user logon.
Adversaries abuse task scheduling utilities to execute malicious code at fixed intervals or system startup.