- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G0105 · 10 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0287 · darkvishnya
What it is
DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0105
Tools
The tools and malware families the sources tie to it.
- FLASHFLOOD
- MINI-MO
- PsExec
- Winexe
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de