MalwareRansomwareUsed by 2 actors

TerraTV

TerraTV is a malware variant associated with the Evilnum threat group and referenced as part of the broader Golden Chickens/Venom Spider malware ecosystem. In the provided reporting, TerraTV is used post-compromise to abuse legitimate TeamViewer software for remote access to victim machines. Specifically, Evilnum used TerraTV to run a legitimate TeamViewer application to connect to compromised systems and to load a malicious DLL from the TeamViewer directory instead of the legitimate Windows DLL from a system folder, indicating DLL hijacking/side-loading behavior. TerraTV is described alongside other Evilnum/Golden Chickens tooling such as More_eggs, TerraPreter, TerraStealer, TerraCrypt, TerraRecon, TerraWiper, RevC2, VenomLNK, TerraLoader, and Venom Loader. The activity is tied to Evilnum campaigns targeting FinTech companies in the UK and EU, with initial access in related reporting achieved through spearphishing lures themed around KYC documents, malicious links, ZIP archives, and LNK files. High-confidence behavior directly stated for TerraTV is TeamViewer hijacking/abuse for remote access and malicious DLL loading from the TeamViewer directory.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Evilnum

Among the tools used by the Evilnum group are More_eggs, TerraPreter, TerraStealer, and TerraTV.

via cybereason blogcybereason.com

FIN6

These modules include TerraStealer for credential harvesting, TerraTV for TeamViewer hijacking, and TerraCrypt for ransomware deployment.

via recorded future blogrecordedfuture.com

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574.001DLLEvidence1

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

Stealth

1 technique

T1574.001DLLEvidence1

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network. During C0018, the threat actors used AnyDesk to transfer tools between systems.

Command and Control

1 technique

T1219.002Remote Desktop SoftwareEvidence1

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

polyswarmNews

May 9, 2025

Venom Spider Using New TerraStealerV2 and TerraLogger Malware

"Related Families: VenomLNK, TerraLoader, TerraStealer, TerraTV, TerraCrypt, TerraRecon, TerraWiper, lite_more_eggs, RevC2, Venom Loader"

recorded future blogNews

May 1, 2025

TerraStealerV2 and TerraLogger: Golden Chickens' New Malware Families Discovered

Golden Chickens module used for TeamViewer hijacking to facilitate remote access/control.

cybereason blogNews

Jan 1, 2025

No Rest for the Wicked: Evilnum Unleashes PyVil RAT

A named malware/tool in the Golden Chickens ecosystem that the content states was used by Evilnum.

mitre attack websiteNews

Jan 22, 2021

Evilnum, Group G0120 | MITRE ATT&CK®

A malware variant associated with Evilnum that performs DLL sideloading via the TeamViewer directory and facilitates remote access by launching legitimate TeamViewer on compromised hosts.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.