HOMETHREATSTerraTV
APT / THREAT GROUP

TerraTV

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

TerraTV is a custom DLL designed to hijack legit TeamViewer applications. It was discovered and documented by QuoINT. It has been attributed to Golden Chickens malware as a service group.

Threat Analysis

TerraTV is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.minerva-labs.com/taurus-user-guided-infection
→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
→https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9
→https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

win.terra_tvTerraTVTaurus Loader TeamViewer Module

External Intelligence

Malpedia: win.terra_tv

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search TerraTV