Forensia CTI Core

Profile

DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.

MITRE ATT&CK ↗

Techniques

10 ATT&CK techniques attributed to this actor.

T1040 Network Sniffing T1046 Network Service Discovery T1059.001 PowerShell T1110 Brute Force T1135 Network Share Discovery T1200 Hardware Additions T1219 Remote Access Tools T1543.003 Windows Service T1571 Non-Standard Port T1588.002 Tool

Software

2 malware/tools attributed to this actor.

PsExecWinexe

Related corpus activity

7,933 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to DarkVishnya.

Indicator	Type	Family	Sev	Src
cve-2026-4368	cve	ransomware	85	1
cve-2018-8007	cve	—	85	1
cve-2025-34054	cve	—	85	4
cve-2025-2492	cve	—	85	2
cve-2016-0638	cve	phishing	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2013-3307	cve	—	85	2
cve-2016-15047	cve	—	85	4
cve-2026-3102	cve	—	85	3
cve-2020-22658	cve	—	85	2
cve-2021-27137	cve	—	85	8
cve-2022-47945	cve	—	85	1
cve-2017-17215	cve	—	85	2
cve-2020-22653	cve	—	85	2
cve-2016-5681	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2025-11837	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2024-1781	cve	—	85	1
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
b8eed63ab9cbdca494f26a6f66bfd4a0a693b3f0	hash	—	80	3
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695f	sha256	phishing	80	2
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3b	sha256	phishing	80	2
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
50ebf107d522326c9a9db8821fe3263aa5136964faaf5dd183657bbb52725f84	sha256	phishing	80	2

Showing the top 30 by severity of 7,933.