Evil Corp

Reported Context (8)

Publicly reported threat group with significant overlap with UNC2165; the report describes UNC2165's use of initial-access partnerships and ransomware. Mandiant M-Trends 2026: Voice Phishing Becomes Second-Most Common Intrusion Vector
SocGholish has long been associated with Evil Corp. The article describes Evil Corp as a Russia-based cybercrime group and says U.S. authorities sanctioned it in 2019 for developing and distributing Dridex. International Operation Disrupts SocGholish Botnet Linked to Evil Corp
Named as a threat actor that has used SocGholish to deliver follow-on payloads. The article says DEV-0243, Indrik Spider, and UNC2165 are aliases for Evil Corp. Operation Endgame Takes Down 106 SocGholish Servers and Cleans Nearly 15,000 WordPress Sites
The SocGholish operator has been associated with Evil Corp, which the source describes as believed to be linked to Russian intelligence. Authorities Disrupt SocGholish Botnet, Clean Nearly 15,000 WordPress Sites
The article links Evil Corp, described as a Russian cybercrime group, to SocGholish and reports that it used infrastructure seized in the operation. Authorities Disrupt SocGholish Botnet Linked to Evil Corp

CVE (5)

Malware (39)

People (2)

Threat Actors (42)

MITRE ATT&CK (23)

Vendors (8)

Products (16)

Tools (13)

Industries (25)

Countries (27)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.