DarkVishnya is a threat group targeting banks with physical intrusion devices.
DarkVishnya is a threat group that targets banks using physical intrusion devices. They utilize hardware like Bash Bunny, netbooks, or Raspberry Pi for initial access, then deploy tools such as PsExec and PowerShell to create Windows Services for persistence and lateral movement. Defenders should prioritize physical security against unauthorized USB devices, monitor for creation of suspicious Windows services, and inspect network traffic for remote access tools communicating over non-standard ports.
Dubbed DarkVishnya, the attacks targeted at least eight banks using readily-available gear such as netbooks or inexpensive laptops, Raspberry Pi mini-computers, or a Bash Bunny - a USB-sized piece hardware for penetration testing purposes that can pose as a keyboard, flash storage, network adapter, or as any serial device.
Monitor network traffic to detect acquisition of Tool in security control systems.
Implement endpoint controls to detect new Hardware Additions to the network.
Monitor PowerShell execution and detect suspicious scripts.
Monitor system logs to detect new Windows Service creation attempts.
Monitor network traffic to detect Network Sniffing activity and detect Brute Force attacks.
Monitor network traffic and system logs to detect Network Service Discovery and Network Share Discovery.
Monitor network traffic to detect Remote Access Tools using Non-Standard Port.
DarkVishnya uses USB-based devices such as Bash Bunny, netbooks, or Raspberry Pi for initial access. The Bash Bunny can pose as a keyboard, flash storage, network adapter, or any serial device.
Defenders should prioritize physical security against unauthorized USB devices, monitor for creation of suspicious Windows services, and inspect network traffic for remote access tools communicating over non-standard ports.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.