Threat actor
Evil Corp
Russia
Tracked by CyberSIXT since 19 Jun
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 4
6 articles from 1 outlet since 19 Jun; the latest 123 days ago.
- Article
- First report
- Research report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 25 Jun · 03:31 UTC | SecurityOnline | Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware |
| Wed 24 Jun · 19:31 UTC | Security Affairs | Europol seizes StealC, Amadey, SocGholish in Operation Endgame |
| Tue 23 Jun · 14:03 UTC | Dark Reading | Global raid dismantles SocGholish malware used by ransomware |
| Fri 19 Jun · 16:50 UTC | Malwarebytes | Operation Endgame Shuts Down SocGholish, Cleans 15k WP Sites |
| Fri 19 Jun · 10:40 UTC | Infosecurity | Dutch Police Lead Global Takedown of SocGholish Malware Botnet |
| Fri 19 Jun · 07:29 UTC | SecurityWeek | Global police take down SocGholish malware, protect 15k WP sites |
Names and sources
- Evil Corp
- Named by CyberSIXT coverage
- Evil Corp
- Named by Malpedia · evil_corp
- GOLD DRAKE
- Named by Malpedia · evil_corp
- DEV-0243
- Named by Microsoft · Manatee Tempest
- INDRIK SPIDER
- Named by Microsoft · Manatee Tempest
- Manatee Tempest
- Named by Microsoft · Manatee Tempest
- Evil Corp
- Named by MISP Galaxy · c30fbdc8-b66d-4242-a02a-e01946bc86d8
- GOLD DRAKE
- Named by MISP Galaxy · c30fbdc8-b66d-4242-a02a-e01946bc86d8
All 14 names
- DEV-0243
- Named by MITRE ATT&CK® · G0119
- Evil Corp
- Named by MITRE ATT&CK® · G0119
- Indrik Spider
- Named by MITRE ATT&CK® · G0119
- Manatee Tempest
- Named by MITRE ATT&CK® · G0119
- UNC2165
- Named by MITRE ATT&CK® · G0119
- c30fbdc8-b66d-4242-a02a-e01946bc86d8
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Manatee Tempest)
- origin
- Russia (Microsoft · Manatee Tempest)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0119) PsExec (MITRE ATT&CK® · G0119) Cobalt Strike (MITRE ATT&CK® · G0119) Empire (MITRE ATT&CK® · G0119) Dridex (MITRE ATT&CK® · G0119) BitPaymer (MITRE ATT&CK® · G0119) WastedLocker (MITRE ATT&CK® · G0119) Donut (MITRE ATT&CK® · G0119) Dridex (Malpedia · evil_corp) PayloadBIN (Malpedia · evil_corp)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0119
Execution
Stealth
- T1036.005
- Match Legitimate Resource Name or Location
Credential Access
- T1003.001
- LSASS Memory
Collection
- T1074.001
- Local Data Staging
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Operation Endgame Takes Down SocGholish, Amadey, and StealC MalwareSecurityOnline
- Europol seizes StealC, Amadey, SocGholish in Operation EndgameSecurity Affairs
- Global raid dismantles SocGholish malware used by ransomwareDark Reading
- Operation Endgame Shuts Down SocGholish, Cleans 15k WP SitesMalwarebytes
- Dutch Police Lead Global Takedown of SocGholish Malware BotnetInfosecurity
- Global police take down SocGholish malware, protect 15k WP sitesSecurityWeek · first in our coverage