MrNervous
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 12 incidents
- Sources
- 9 sources
- First seen
- 2014-02-09
- Last seen
- 2022-11-10
- Updated
- 2026-10-18 04:42
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor, known by the aliases MrNervous, WhiteHatMrNervous and also observed as W0rm, is based in Russia. Targeting has included financial institutions such as a multinational investment bank (allegedly Deutsche Bank), health‑sector entities like an Australian health insurer and a Russian Ministry of Health, and media organizations including the BBC, Vice Media, The Wall Street Journal and CNET. The actor’s objectives have been both financial—offering network access, domain administrator passwords, VPN/VDI entry and stolen databases for Bitcoin—and, in some operations, claimed to be altruistic, aiming to expose security weaknesses rather than profit. Observed tactics involve exploiting weak or default credentials (e.g., Citrix123), leveraging SQL‑injection flaws in web applications, abusing open VNC ports with disabled authentication, and using Telegram or underground forums to advertise and sell access. The actor has also been noted to provide proof‑of‑funds demands and to accept payment in Bitcoin via exploit marketplaces such as w0rm.in. While the actor operates as a Russian‑based individual or loose collective, no public attribution to a state sponsor has been made. Representative operations include the 2022 alleged breach of Deutsche Bank’s network, the 2022 intrusion into a Russian Ministry of Health system via an unauthenticated VNC port, the 2014 leak of Flight Centre Travel Group data after a SQL‑injection in Parallels Plesk, and the 2014 compromises of The Wall Street Journal, CNET and Vice.com websites where user data was offered for sale for one Bitcoin.
Incidents
Attributed incidents are available to members.
12 incidentsSources
Sources available to members: 9 sources.