Skip to content
Section B · Adversaries · Dossier
← Adversaries

File · DarkVishnya · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

DarkVishnya

MITRE G0105 ↗

DarkVishnya — ATT&CK roseDA

attack rose · 10 techniques across 7 tactics

Analyst brief

misp-galaxy + mitre-attack

Dubbed DarkVishnya, the attacks targeted at least eight banks using readily-available gear such as netbooks or inexpensive laptops, Raspberry Pi mini-computers, or a Bash Bunny - a USB-sized piece hardware for penetration testing purposes that can pose as a keyboard, flash storage, network adapter, or as any serial device.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

10 techniques · 7 of 15 tactics

  1. Resource development

    1 technique
  2. Initial access

    1 technique
  3. Execution

    1 technique
  4. Persistence

    1 technique
  5. Credential access

    2 techniques
  6. Discovery

    2 techniques
  7. Command and control

    2 techniques

select a technique

Arsenal

2 tools
Tools
Tools · 2ATT&CK
WinexeS0191 ↗
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

3 sources
  1. 1.bleepingcomputer.com/news/security/netbooks-rpis-and-bash-bunny-gear-attack…
  2. 2.attack.mitre.org/groups/G0105
  3. 3.securelist.com/darkvishnya/89169

Track DarkVishnya on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.