Skip to main content
Mallory
MalwareRansomwareUsed by 2 actors

TerraTV

TerraTV is a malware variant associated with the Evilnum threat actor. Based on the provided content, its primary role is to abuse legitimate TeamViewer software for remote access on compromised machines. Evilnum has used TerraTV to load a malicious DLL from the TeamViewer directory instead of the legitimate Windows DLL located in a system folder, indicating DLL hijacking/side-loading behavior. TerraTV has also been used to launch a legitimate TeamViewer application to connect to compromised systems. The surrounding Evilnum activity described in the content includes spearphishing links and malicious shortcut-based lures leading to .LNK downloads, JavaScript execution, deployment of additional tools, browser cookie and web session theft, email credential collection, file deletion, and sandbox-detection checks via TerraLoader. TerraTV is listed alongside related Evilnum/Golden Chickens tooling including VenomLNK, TerraLoader, TerraStealer, TerraCrypt, TerraRecon, TerraWiper, lite_more_eggs, RevC2, and Venom Loader. High-confidence behavior directly attributed to TerraTV in the content is TeamViewer hijacking/abuse for remote access through malicious DLL loading in the TeamViewer directory.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
FIN6

These modules include TerraStealer for credential harvesting, TerraTV for TeamViewer hijacking, and TerraCrypt for ransomware deployment.

via recorded future blogrecordedfuture.com
Evilnum

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory...

via mitre attack websiteattack.mitre.org
MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1574.001DLLEvidence1

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

Stealth

1 technique
T1574.001DLLEvidence1

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

Lateral Movement

1 technique
T1021Remote ServicesEvidence1

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network. During C0018, the threat actors used AnyDesk to transfer tools between systems.

T1219.002Remote Desktop SoftwareEvidence1

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.