KovCoreG
KovCoreG is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in the United States. It uses 14 MITRE ATT&CK techniques.
- Techniques
- 14
- Exploited CVEs
- No CVE data
- First seen
- Oct 1, 2019
- Last seen
- Oct 1, 2019
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
14 techniques across 6 of 14 tacticsReconnaissance2
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
T1497
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion
Resource Development·
Execution2
T1055.001
Process Injection: Dynamic-link Library Injection
Process Injection: Dynamic-link Library Injection
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
Persistence2
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1622
Debugger Evasion
Debugger Evasion
Privilege Escalation1
T1548.002
Abuse Elevation Control Mechanism: Bypass User Account Control
Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion5
T1090
Proxy
Proxy
T1218.005
System Binary Proxy Execution: Mshta
System Binary Proxy Execution: Mshta
T1497.001
Virtualization/Sandbox Evasion: System Checks
Virtualization/Sandbox Evasion: System Checks
T1562.001
Impair Defenses: Disable or Modify Tools
Impair Defenses: Disable or Modify Tools
T1573.001
Encrypted Channel: Symmetric Cryptography
Encrypted Channel: Symmetric Cryptography
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Divergentmalware
- WinDivertmalware
- Invoke-PSInjecttool
- Node.jstool
Campaigns.
- KovCoreG Malvertising CampaignOct 2019
About KovCoreG.
Cybercriminal threat group known for malvertising operations, click-fraud schemes, and distributing malware disguised as software updates such as Adobe Flash.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.