Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 23:04:51 UTC
Home > List all groups > Deceptikons, DeathStalker
 APT group: Deceptikons, DeathStalker
Names
Deceptikons (Kaspersky)
DeathStalker (Kaspersky)
Country [Unknown]
Motivation Information theft and espionage
First seen 2012
Description
(Kaspersky) In this blog post, we’ll be focusing on DeathStalker: a unique threat
group that appears to target law firms and companies in the financial sector
(although we’ve occasionally seen them in other verticals as well). As far as we can
tell, this actor isn’t motivated by financial gain. They don’t deploy ransomware, steal
payment information to resell it, or engage in any type of activity commonly
associated with the cybercrime underworld. Their interest in gathering sensitive
business information leads us to believe that DeathStalker is a group of mercenaries
offering hacking-for-hire services, or acting as some sort of information broker in
financial circles.
DeathStalker first came to our attention through a PowerShell-based implant called
Powersing. By unraveling this thread, we were able to identify activities dating back
to 2018, and possibly even 2012.
There is activity overlap with Evilnum.
Observed
Sectors: Financial and law firms.
Countries: Argentina, China, Cyprus, India, Israel, Jordan, Lebanon, Russia,
Switzerland, Taiwan, Turkey, UAE, UK.
Tools used Evilnum, Janicab, PowerPepper, Powersing, VileRAT.
Operations performed
2020
DeathStalker targets legal entities with new Janicab variant
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=55986798-f21d-4c64-9f5b-57676bf32241
Page 1 of 2

May 2020
Meet PowerPepper: the spicy implant that your bland scripts setup
needed
Jun 2020
VileRAT: DeathStalker’s continuous strike at foreign and
cryptocurrency exchanges
Information
Last change to this card: 27 December 2022
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=55986798-f21d-4c64-9f5b-57676bf32241
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=55986798-f21d-4c64-9f5b-57676bf32241
Page 2 of 2