Loading threat actor…
Necurs was a major criminal spam botnet used for large-scale email distribution of malware and fraud campaigns. It was widely associated with delivery of Locky ransomware and the Dridex banking trojan, and it also conducted high-volume pump-and-dump stock spam operations. Its operators demonstrated the ability to rapidly shift monetization strategies, alternating between malware delivery and market-manipulation spam while maintaining substantial spam-sending capacity. Necurs commonly used email-based initial access, including transaction-themed and invoice-themed lures, and distributed malicious attachments packaged in compressed archives. In ransomware delivery activity, it was used to spread Locky through malspam campaigns and showed operational reuse of established tradecraft across campaigns. In financial crime activity, Necurs also sent attachment-free stock-promotion spam consistent with pump-and-dump schemes, indicating that the botnet functioned as a flexible criminal distribution platform rather than a single-purpose malware operation. The actor’s observed capabilities center on initial access via spam distribution and follow-on malware delivery in support of credential theft, financial fraud, and extortion ecosystems. Necurs is best characterized as a financially motivated cybercriminal operation rather than a state-sponsored threat actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
27 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
28 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operating a ransomware-oriented spam campaign distributing Locky via malicious email attachments, after previously switching from Locky to Jaff.
Operating a large-scale spam botnet used to distribute malware such as Locky and Dridex, and in this report shifting activity toward penny stock pump-and-dump spam campaigns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.