Malware

Kovter

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 29d ago

Timeline2 articles

Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics

Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.

On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.

Palo Alto Unit 42Aug 17, 09:53 UTC · 29d agoRansomware in the wild

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42Aug 17, 09:51 UTC · 29d agoThreat actor in the wild

Appears with

vendor Palo Alto Networks 2 malware Angler EK 1 malware Bedep 1 malware CryptoMix 1 malware KINS 1 malware Miuref 1 malware Mole 1 malware Nemucod 1 malware TeslaCrypt 1 malware Tinba 1 threat actor EITest 1 malware Vawtrak 1 malware Zeus 1 organization Palo Alto Networks 1 organization Unit 42 1 organization USPS 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.