Wiki › Adversaries & Campaigns › Cybercrime Groups › Evil Corp

Evil Corp

2 min read

Jump to:

Summary

Evil Corp is a notorious cybercriminal group known for conducting sophisticated application attacks, primarily involving ransomware and banking malware. The group has been active since at least 2009 and is responsible for numerous high-profile cyberattacks targeting financial institutions, enterprises, and government organizations worldwide. Their operations often involve deploying malware such as Dridex and BitPaymer to steal credentials, disrupt services, and extort victims.

Key Characteristics

Use of advanced banking Trojans like Dridex to steal financial information and credentials.
Deployment of ransomware variants such as BitPaymer and WastedLocker to encrypt victim data and demand ransom payments.
Targeting of financial institutions, multinational corporations, and critical infrastructure sectors.
Employment of spear-phishing campaigns and social engineering to gain initial access.
Regular updates and modifications to malware to evade detection and improve effectiveness.
Use of obfuscation techniques and multi-stage infection chains.
Attribution to Russian-speaking threat actors with links to organized cybercrime networks.

Defensive Controls

Implementation of advanced email filtering and anti-phishing technologies to block malicious attachments and links.
Regular patching and updating of software to mitigate exploitation of vulnerabilities.
Use of endpoint detection and response (EDR) solutions to identify and contain malware infections.
Network segmentation to limit lateral movement within an organization.
Multi-factor authentication (MFA) to protect user credentials from theft and misuse.
Employee security awareness training focused on recognizing phishing and social engineering attempts.
Regular backups and tested recovery procedures to minimize impact of ransomware attacks.

Related Security Solutions

Security solutions effective against Evil Corp attacks include advanced threat protection platforms, email security gateways, endpoint detection and response (EDR) tools, network intrusion detection systems (NIDS), and security information and event management (SIEM) systems. Additionally, identity and access management (IAM) solutions with multi-factor authentication capabilities play a critical role in preventing credential compromise. Organizations often leverage threat intelligence services to stay informed about Evil Corp tactics, techniques, and procedures (TTPs) to enhance their defensive posture.

Tags: Application Attacks banking malware BitPaymer Dridex endpoint detection and response Evil Corp multi-factor authentication Phishing ransomware Threats & Attacks