GroupProfiles: EvilCorp.md
Recurso del BushidoUK Ransomware Tool Matrix - GroupProfiles.
EvilCorp's Tools
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
| Advanced IP Scanner | NetSupport | | KeeThief | Cobalt Strike | | PsExec | MEGA |
| Lansweeper | | | Mimikatz | Mythic | | | RClone |
| | | | SecretServerSecretStealer | | | | Azure Blob Storage |
> [!NOTE]
> This is the list of tools that have been observed during various intrusions that lead to EvilCorp's ransomware deployment (previously BitPaymer, WastedLocker, PhoenixLocker, MacawLocker, Hades, LockBit, and RansomHub).
#### Sources
| Date Published | Report |
|---|---|
| 2 June 2022 | https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions |
| 16 January 2025 | https://services.google.com/fh/files/misc/threat_horizons_report_h1_2025.pdf |