{ "id": "e8a05cd8-bdcf-4296-81c7-4da04b0f7e37", "created_at": "2026-04-06T00:08:42.659816Z", "updated_at": "2026-04-10T03:37:50.637757Z", "deleted_at": null, "sha1_hash": "e975abe6e455787bd19b3dcee33f9d179e874ad4", "title": "Russia's FSB malign activity: factsheet", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1269775, "plain_text": "Russia's FSB malign activity: factsheet\r\nArchived: 2026-04-02 10:45:11 UTC\r\nCyber operations and the Russian intelligence services\r\nRussia is one of the world’s most prolific cyber actors and dedicate significant resource into conducting cyber operations\r\naround the globe. The UK government has publicly attributed malign cyber activity to parts of three Russian Intelligence\r\nservices: the FSB, SVR and GRU, with each having their own remits.\r\nA table of the parts of the Russian Intelligence Services that the UK Government has publicly attributed is below.\r\nRussian Intelligence Services cyber organogram\r\nOrganogram showing the Russian Intelligence Services cyber structure.\r\nText alternative for the organogram: the Russin Intelligence Services Cyber Structure includes:\r\nFSB (federal Security Service)\r\nCentre 16L Centre of the collection of radio-electronic intelligence on communications facilities, post number 71330.\r\nPublicly known as Energetic bear, Berserk Bear, Dragonfly, IRON LIBERTY, CASSTLE, CROUCHING YETI,\r\nDYMALLOY, TG-4192, Snake, Venomous Bear, Turla, Uroboros\r\nCentre 18: Centre for Information Security (TsIB), military unit 64829. Publicly known as: Star Blizzard,\r\nSEABORGIUM, Calisto Group, TA446, COLDRIVER, TAG:53, Blue Charlie\r\nSVR (Foreign Intelligence Service), publicly known as APT29, Cosy Bear, The Dukes\r\nGRU (Military Intelligence)\r\nGRU 85th, field post number 26165. Publicly known as APT28, Fancy Bear, Strontium\r\nGRU GTsST: field post number 74455. Publicly known as: Sandworm\r\nThe FSB cyber programme\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 1 of 6\n\nThe FSB (Federal Security Service; Russian: (Федеральная служба безопасности (ФСБ)) is Russia’s state security agency\r\nand the successor to the KGB. Since its formation in (1995 the FSB has conducted electronic surveillance of equipment. The\r\nUK has exposed the involvement of 2 FSB Centres in cyber activity directed against the UK.\r\nCentre 16 supports Foreign Intelligence collection, as well as supporting the wider FSB mission (to include\r\nprotection of the constitution)\r\nCentre 18 sits within the Counter-Intelligence Service of the FSB (Service 1)\r\nFSB Centre 16\r\nFSB Centre 16 (16-й Центр) is responsible for cyber operations including the intercepting, decrypting and processing of\r\nelectronic messages, and the technical penetration of foreign targets. Its full title is the Centre for Radio-Electronic\r\nIntelligence by Means of Communication (TsRRSS; Russian: Центр радиоэлектронной разведки на средствах связи\r\n(ЦPPCC)) and is also known as “Military Unit 71330” (V/Ch 71330) (Bойсковая часть B/Ч 71330).\r\nWhen the KGB was disbanded in 1991, the 16th Directorate of the KGB became FAPSI (Russian: ՓАПϹИ) or Federal\r\nAgency of Government Communications and Information (FAGCI) (Russian :Փедеральное Агентство\r\nПравительственной Ϲвязи и Информации), a Russian government agency, which was responsible for signals intelligence\r\n(SIGINT) and security of governmental communications.\r\nIn 2003, FAPSI was dissolved, and the 3rd Main Department of FAPSI (responsible for SIGINT) was transferred to the FSB\r\nforming the basis for FSB Centre 16.\r\nThe emblem of FSB Centre 16 hints at its activities in cyberspace: a satellite dish (signifying SIGINT activity) and a key,\r\nbroken by lightning, (signifying the breaking of an encryption key) are both present.\r\nEmblem of FSB Centre 16\r\nCyber operations conducted by FSB Centre 16\r\nFSB Centre 16 has been observed conducting cyber operations since at least 2010. They conducted significant campaigns\r\nagainst the energy sector in 2014 and the aviation sector in 2020.\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 2 of 6\n\nFSB Centre 16 is also responsible for snake malware and its variants which have been a core component in espionage\r\noperations conducted by Centre 16 for nearly 2 decades. The implant has been used to collect sensitive information from\r\nspecific targets, such as government networks, research facilities and journalists, with Snake infrastructure identified in\r\nmore than 50 countries across the world.\r\nCyber operations against worldwide critical national infrastructure\r\nCentre 16 of the FSB have targeted/gained unauthorised access systems in countries around the world that are necessary for\r\na country to function and upon which daily life depends. Known as Critical National Infrastructure or CNI, Centre 16 has\r\ntargeted systems essential for energy, healthcare, finance, education and local/national governments. This has been a\r\nconcerted campaign over many years and in a wide range of countries across Europe, the Americas and Asia.\r\nThe National Cyber Security Centre (NCSC) and cyber security companies have warned network defenders on multiple\r\noccasions of the risks posed by this pattern of activity. While there has been speculation of FSB involvement, the UK\r\ngovernment is confirming this activity was carried out by FSB Centre 16 and providing further details of specific examples\r\nof this activity to increase awareness and transparency around the threat.\r\nTable 1: Cyber operations against CNI\r\nDate Activity\r\nDescription\r\nof targets\r\nFurther information\r\nJune to\r\nJuly 2013\r\nCompromised\r\nsoftware\r\npackage,\r\nturning the\r\nsoftware into a\r\nTrojan, a\r\nlegitimate\r\nappearing\r\nprogramme\r\nthat contains\r\nmalware\r\nEuropean\r\nmanufacturer\r\nof\r\nprogrammable\r\nlogic\r\ncontroller\r\ndevices\r\nSymantec report:\r\nhttps://community.broadcom.com/symantecenterprise/communities/community\r\nhome/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-\r\n84cc-890971ed3f17\u0026CommunityKey=1ecf5f55-9545-44d6-b0f4-\r\n4e4a7f5f5e68\u0026tab=librarvdocuments\r\nApril\r\n2014\r\nCompromised\r\nsoftware\r\nEuropean\r\ndeveloper of\r\nwind turbines,\r\nbio gas and\r\nother energy\r\ninfrastructure\r\nSymantec report:\r\nhttps://community.broadcom.com/symantecenterprise/communities/community\r\nhome/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-\r\n84cc-890971ed3f17\u0026CommunityKey=1ecf5f55-9545-44d6-b0f4-\r\n4e4a7f5f5e68\u0026tab=librarvdocuments\r\nApril\r\n2017\r\nConducted\r\nmalicious\r\ncyber activity\r\nUK\r\ncompanies\r\nassociated\r\nwith the\r\nenergy sector\r\n \r\nOctober\r\n2017\r\nGained\r\nunauthorised\r\naccess to and\r\ncompromised\r\nEuropean and\r\nNorth\r\nAmerican\r\nenergy sector\r\nSymantec report: Dragonfly: Western energy sector targeted by sophisticated\r\nattack group https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks. Symantec indicate that the\r\nactors may have “access to operational systems”\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 3 of 6\n\nDate Activity\r\nDescription\r\nof targets\r\nFurther information\r\nmultiple\r\nnetworks\r\nthrough\r\nmalicious\r\ncyber activity\r\nincluding\r\nspear phishing\r\nMarch\r\n2018\r\nConducted\r\nspear\r\nphishing,\r\ncaptured user\r\ncredentials,\r\ngained\r\nunauthorised\r\naccess to CNI\r\nand exfiltrated\r\ndata\r\nUS energy,\r\nnuclear,\r\ncommercial\r\nfacilities,\r\nwater,\r\naviation and\r\ncritical\r\nmanufacturing\r\nsectors\r\nUS Cybersecurity and Infrastructure security agency advisory\r\nhttps://www.cisa.gov/uscert/ncas/alerts/aa22-074a. [The advisory states that the\r\nactivity detailed was performed by Russia government actors and points to the\r\nSymantec report detailed above (October 2017) that details malicious activity\r\nperformed by the group called “Dragonfly”]\r\nApril\r\n2018\r\nCompromising\r\nUK\r\norganisations\r\nwith focus on\r\nengineering\r\nand industrial\r\ncontrol\r\ncompanies.\r\nAttackers may\r\nbe able to\r\naccess contact\r\nlists of hacked\r\ncompanies and\r\nestablish long\r\nterm access to\r\nnetworks\r\nUK\r\nengineering\r\nand industrial\r\ncontrol\r\ncompanies\r\nNCSC advisory: https://www.ncsc.gov.uk/news/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control\r\nFebruary\r\n2020 to\r\nAugust\r\n2020\r\nSustained and\r\nsubstantial\r\nscanning and\r\nprobing of\r\nnetworks\r\nAmerican\r\naviation\r\nsector\r\nThis reconnaissance could be used to gain access at a later date\r\nSeptember\r\n2020\r\nonwards\r\nTargeted and\r\nexfiltrated\r\ndata\r\nAmerican\r\naviation\r\nsector and\r\nother key US\r\ntargets\r\nCISA alert AA20-296A\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 4 of 6\n\nCyber operations against dissidents, political opponents and the Russian public\r\nThe UK government has identified FSB Centre 16 actors using cyber operations to monitor or attempt to gain unauthorised\r\naccess to the computer systems of dissidents, political opponents and the Russian public.\r\nTable 2: Cyber operations conducted by FSB Centre 16 against dissidents, prominent Kremlin critics and the\r\nRussian public\r\nDate Activity Further information\r\nSeptember\r\n2017\r\nGained unauthorised access to the email\r\naddress of an associate of Aleksey\r\nNavalny\r\nAleksey Navalny is a prominent critic of Putin and a\r\nstrong advocate for democracy in Russia. In August 2020\r\nNavalny was poisoned in Russia. Following treatment in\r\nGermany he returned to Russia and was arrested on arrival\r\nOctober\r\n2019 to\r\nJanuary\r\n2020\r\nPosing as the Russian Federal Tax\r\nService, conducted spear phishing\r\nagainst multiple Russian nationals\r\nMany of the targets are critics of the current administration\r\nFebruary\r\n2020\r\nAttempted to Spear-phish the press\r\nsecretary of Mikhail Khodorkovskiy\r\n1: Mikhail Khodorkovskiy is a prominent critic of the\r\nRussian administration and currently resides in the UK. 2:\r\nMikhail Khodorkovskiy has said he believes himself to be\r\nat serious risk from harm at the hands of the Russian state.\r\nHe currently resides in the UK. The press secretary would\r\nbe expected to have access to Mikhail Khodorkovskiy’s\r\ndiary and travel plans\r\nMay 2020\r\nMonitored the website “dossier.center”,\r\na website set up by Mikhail\r\nKhodorkovskiy to expose corruption\r\nwithin the Russian government. This\r\nactivity occurred shortly after the\r\nwebsite released information about the\r\nFSB\r\nThis activity likely represents intelligence gathering\r\nagainst groups connected to Mikhail Khodorkovskiy\r\nFSB Centre 18\r\nFSB Centre 18 is also known as the Centre for Information Security (TsIB) Military Unit 64829.  Centre 18 sits within the\r\nFSB 1st Service (Counter-intelligence Service). NCSC assesses that Star Blizzard is almost certainly subordinate to the\r\nRussian Federal  Security Service (FSB) Centre 18.\r\nStar Blizzard have conducted cyber espionage operations targeting the UK, including key parts of the democratic and\r\npolitical process. The group have also selectively leaked and amplified the release of information in line with Russian\r\ninformation confrontation priorities, including to undermine trust in politics in the UK and likeminded states.\r\nNCSC has warned of the risks posed by this pattern of activity, including in a technical advisory in January. While there has\r\nbeen speculation of FSB involvement, the UK government is confirming this activity was carried out by a group subordinate\r\nto FSB Centre 18 and providing further details of specific examples of this activity to increase awareness and transparency\r\naround the threat.\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 5 of 6\n\nEmblem of FSB Centre 18\r\nTable 3: Cyber operations conducted by Star Blizzard against high-profile UK political figures and\r\norganisations\r\nDate Activity Further information\r\nFrom at least\r\n2015 to 2023\r\nTargeting of UK\r\nParliamentarians\r\nTargeting of Parliamentarians from multiple, parties, including\r\nimpersonation of individuals and spear-phishing attempts.\r\n2018\r\nHack of the Institute for\r\nStatecraft\r\nHack of the institute for Statecraft, a UK thinktank whose work\r\nincluded initiatives to defend democracy against disinformation –\r\nthe documents subsequently leaked.\r\n2019\r\nHack of UK-US trade\r\ndocuments\r\nThe hack of UK-US trade documents that were leaked ahead of\r\nthe 2019 UK General Election.\r\nFrom\r\nDecember\r\n2021\r\nHack of Institute for Statecraft\r\nfounded Christopher Donnelly\r\nThe hack of Institute for Statecraft founder Christopher Donnelly\r\n– documents were subsequently leaked.\r\nSource: https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nhttps://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia", "MITRE" ], "references": [ "https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet" ], "report_names": [ "russias-fsb-malign-activity-factsheet" ], "threat_actors": [ { "id": "8aaa5515-92dd-448d-bb20-3a253f4f8854", "created_at": "2024-06-19T02:03:08.147099Z", "updated_at": "2026-04-10T02:00:03.685355Z", "deleted_at": null, "main_name": "IRON HUNTER", "aliases": [ "ATK13 ", "Belugasturgeon ", "Blue Python ", "CTG-8875 ", "ITG12 ", "KRYPTON ", "MAKERSMARK ", "Pensive Ursa ", "Secret Blizzard ", "Turla", "UAC-0003 ", "UAC-0024 ", "UNC4210 ", "Venomous Bear ", "Waterbug " ], "source_name": "Secureworks:IRON HUNTER", "tools": [ "Carbon-DLL", "ComRAT", "LightNeuron", "Mosquito", "PyFlash", "Skipper", "Snake", "Tavdig" ], "source_id": "Secureworks", "reports": null }, { "id": "649b5b3e-b16e-44db-91bc-ae80b825050e", "created_at": "2022-10-25T15:50:23.290412Z", "updated_at": "2026-04-10T02:00:05.257022Z", "deleted_at": null, "main_name": "Dragonfly", "aliases": [ "TEMP.Isotope", "DYMALLOY", "Berserk Bear", "TG-4192", "Crouching Yeti", "IRON LIBERTY", "Energetic Bear", "Ghost Blizzard" ], "source_name": "MITRE:Dragonfly", "tools": [ "MCMD", "Impacket", "CrackMapExec", "Backdoor.Oldrea", "Mimikatz", "PsExec", "Trojan.Karagany", "netsh" ], "source_id": "MITRE", "reports": null }, { "id": "79bd28a6-dc10-419b-bee7-25511ae9d3d4", "created_at": "2023-01-06T13:46:38.581534Z", "updated_at": "2026-04-10T02:00:03.029872Z", "deleted_at": null, "main_name": "Callisto", "aliases": [ "BlueCharlie", "Star Blizzard", "TAG-53", "Blue Callisto", "TA446", "IRON FRONTIER", "UNC4057", "COLDRIVER", "SEABORGIUM", "GOSSAMER BEAR" ], "source_name": "MISPGALAXY:Callisto", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "90307967-d5eb-4b7b-b8de-6fa2089a176e", "created_at": "2022-10-25T15:50:23.501119Z", "updated_at": "2026-04-10T02:00:05.347826Z", "deleted_at": null, "main_name": "Dragonfly 2.0", "aliases": [ "Dragonfly 2.0", "IRON LIBERTY", "DYMALLOY", "Berserk Bear" ], "source_name": "MITRE:Dragonfly 2.0", "tools": [ "netsh", "Impacket", "MCMD", "CrackMapExec", "Trojan.Karagany", "PsExec" ], "source_id": "MITRE", "reports": null }, { "id": "5b748f86-ac32-4715-be9f-6cf25ae48a4e", "created_at": "2024-06-04T02:03:07.956135Z", "updated_at": "2026-04-10T02:00:03.689959Z", "deleted_at": null, "main_name": "IRON HEMLOCK", "aliases": [ "APT29 ", "ATK7 ", "Blue Kitsune ", "Cozy Bear ", "The Dukes", "UNC2452 ", "YTTRIUM " ], "source_name": "Secureworks:IRON HEMLOCK", "tools": [ "CosmicDuke", "CozyCar", "CozyDuke", "DiefenDuke", "FatDuke", "HAMMERTOSS", "LiteDuke", "MiniDuke", "OnionDuke", "PolyglotDuke", "RegDuke", "RegDuke Loader", "SeaDuke", "Sliver" ], "source_id": "Secureworks", "reports": null }, { "id": "1a76ed30-4daf-4817-98ae-87c667364464", "created_at": "2022-10-25T16:47:55.891029Z", "updated_at": "2026-04-10T02:00:03.646466Z", "deleted_at": null, "main_name": "IRON LIBERTY", "aliases": [ "ALLANITE ", "ATK6 ", "BROMINE ", "CASTLE ", "Crouching Yeti ", "DYMALLOY ", "Dragonfly ", "Energetic Bear / Berserk Bear ", "Ghost Blizzard ", "TEMP.Isotope ", "TG-4192 " ], "source_name": "Secureworks:IRON LIBERTY", "tools": [ "ClientX", "Ddex Loader", "Havex", "Karagany", "Loek", "MCMD", "Sysmain", "xfrost" ], "source_id": "Secureworks", "reports": null }, { "id": "a241a1ca-2bc9-450b-a07b-aae747ee2710", "created_at": "2024-06-19T02:03:08.150052Z", "updated_at": "2026-04-10T02:00:03.737173Z", "deleted_at": null, "main_name": "IRON RITUAL", "aliases": [ "APT29", "Blue Dev 5 ", "BlueBravo ", "Cloaked Ursa ", "CozyLarch ", "Dark Halo ", "Midnight Blizzard ", "NOBELIUM ", "StellarParticle ", "UNC2452 " ], "source_name": "Secureworks:IRON RITUAL", "tools": [ "Brute Ratel C4", "Cobalt Strike", "EnvyScout", "GoldFinder", "GoldMax", "NativeZone", "RAINDROP", "SUNBURST", "Sibot", "TEARDROP", "VaporRage" ], "source_id": "Secureworks", "reports": null }, { "id": "a97cf06d-c2e2-4771-99a2-c9dee0d6a0ac", "created_at": "2022-10-25T16:07:24.349252Z", "updated_at": "2026-04-10T02:00:04.949821Z", "deleted_at": null, "main_name": "Turla", "aliases": [ "ATK 13", "Belugasturgeon", "Blue Python", "CTG-8875", "G0010", "Group 88", "ITG12", "Iron Hunter", "Krypton", "Makersmark", "Operation Epic Turla", "Operation Moonlight Maze", "Operation Penguin Turla", "Operation Satellite Turla", "Operation Skipper Turla", "Operation Turla Mosquito", "Operation WITCHCOVEN", "Pacifier APT", "Pensive Ursa", "Popeye", "SIG15", "SIG2", "SIG23", "Secret Blizzard", "TAG-0530", "Turla", "UNC4210", "Venomous Bear", "Waterbug" ], "source_name": "ETDA:Turla", "tools": [ "ASPXSpy", "ASPXTool", "ATI-Agent", "AdobeARM", "Agent.BTZ", "Agent.DNE", "ApolloShadow", "BigBoss", "COMpfun", "Chinch", "Cloud Duke", "CloudDuke", "CloudLook", "Cobra Carbon System", "ComRAT", "DoublePulsar", "EmPyre", "EmpireProject", "Epic Turla", "EternalBlue", "EternalRomance", "GoldenSky", "Group Policy Results Tool", "HTML5 Encoding", "HyperStack", "IcedCoffee", "IronNetInjector", "KSL0T", "Kapushka", "Kazuar", "KopiLuwak", "Kotel", "LOLBAS", "LOLBins", "LightNeuron", "Living off the Land", "Maintools.js", "Metasploit", "Meterpreter", "MiamiBeach", "Mimikatz", "MiniDionis", "Minit", "NBTscan", "NETTRANS", "NETVulture", "Neptun", "NetFlash", "NewPass", "Outlook Backdoor", "Penquin Turla", "Pfinet", "PowerShell Empire", "PowerShellRunner", "PowerShellRunner-based RPC backdoor", "PowerStallion", "PsExec", "PyFlash", "QUIETCANARY", "Reductor RAT", "RocketMan", "SMBTouch", "SScan", "Satellite Turla", "SilentMoon", "Sun rootkit", "TTNG", "TadjMakhal", "Tavdig", "TinyTurla", "TinyTurla Next Generation", "TinyTurla-NG", "Topinambour", "Tunnus", "Turla", "Turla SilentMoon", "TurlaChopper", "Uroburos", "Urouros", "WCE", "WITCHCOVEN", "WhiteAtlas", "WhiteBear", "Windows Credential Editor", "Windows Credentials Editor", "Wipbot", "WorldCupSec", "XTRANS", "certutil", "certutil.exe", "gpresult", "nbtscan", "nbtstat", "pwdump" ], "source_id": "ETDA", "reports": null }, { "id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df", "created_at": "2023-01-06T13:46:38.402513Z", "updated_at": "2026-04-10T02:00:02.959797Z", "deleted_at": null, "main_name": "Sandworm", "aliases": [ "IRIDIUM", "Blue Echidna", "VOODOO BEAR", "FROZENBARENTS", "UAC-0113", "Seashell Blizzard", "UAC-0082", "APT44", "Quedagh", "TEMP.Noble", "IRON VIKING", "G0034", "ELECTRUM", "TeleBots" ], "source_name": "MISPGALAXY:Sandworm", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "3aedca2f-6f6c-4470-af26-a46097d3eab5", "created_at": "2024-11-01T02:00:52.689773Z", "updated_at": "2026-04-10T02:00:05.396502Z", "deleted_at": null, "main_name": "Star Blizzard", "aliases": [ "Star Blizzard", "SEABORGIUM", "Callisto Group", "TA446", "COLDRIVER" ], "source_name": "MITRE:Star Blizzard", "tools": [ "Spica" ], "source_id": "MITRE", "reports": null }, { "id": "7bd810cb-d674-4763-86eb-2cc182d24ea0", "created_at": "2022-10-25T16:07:24.1537Z", "updated_at": "2026-04-10T02:00:04.883793Z", "deleted_at": null, "main_name": "Sandworm Team", "aliases": [ "APT 44", "ATK 14", "BE2", "Blue Echidna", "CTG-7263", "FROZENBARENTS", "G0034", "Grey Tornado", "IRIDIUM", "Iron Viking", "Quedagh", "Razing Ursa", "Sandworm", "Sandworm Team", "Seashell Blizzard", "TEMP.Noble", "UAC-0082", "UAC-0113", "UAC-0125", "UAC-0133", "Voodoo Bear" ], "source_name": "ETDA:Sandworm Team", "tools": [ "AWFULSHRED", "ArguePatch", "BIASBOAT", "Black Energy", "BlackEnergy", "CaddyWiper", "Colibri Loader", "Cyclops Blink", "CyclopsBlink", "DCRat", "DarkCrystal RAT", "Fobushell", "GOSSIPFLOW", "Gcat", "IcyWell", "Industroyer2", "JaguarBlade", "JuicyPotato", "Kapeka", "KillDisk.NCX", "LOADGRIP", "LOLBAS", "LOLBins", "Living off the Land", "ORCSHRED", "P.A.S.", "PassKillDisk", "Pitvotnacci", "PsList", "QUEUESEED", "RansomBoggs", "RottenPotato", "SOLOSHRED", "SwiftSlicer", "VPNFilter", "Warzone", "Warzone RAT", "Weevly" ], "source_id": "ETDA", "reports": null }, { "id": "3a0be4ff-9074-4efd-98e4-47c6a62b14ad", "created_at": "2022-10-25T16:07:23.590051Z", "updated_at": "2026-04-10T02:00:04.679488Z", "deleted_at": null, "main_name": "Energetic Bear", "aliases": [ "ATK 6", "Blue Kraken", "Crouching Yeti", "Dragonfly", "Electrum", "Energetic Bear", "G0035", "Ghost Blizzard", "Group 24", "ITG15", "Iron Liberty", "Koala Team", "TG-4192" ], "source_name": "ETDA:Energetic Bear", "tools": [ "Backdoor.Oldrea", "CRASHOVERRIDE", "Commix", "CrackMapExec", "CrashOverride", "Dirsearch", "Dorshel", "Fertger", "Fuerboos", "Goodor", "Havex", "Havex RAT", "Hello EK", "Heriplor", "Impacket", "Industroyer", "Karagany", "Karagny", "LightsOut 2.0", "LightsOut EK", "Listrix", "Oldrea", "PEACEPIPE", "PHPMailer", "PsExec", "SMBTrap", "Subbrute", "Sublist3r", "Sysmain", "Trojan.Karagany", "WSO", "Webshell by Orb", "Win32/Industroyer", "Wpscan", "nmap", "sqlmap", "xFrost" ], "source_id": "ETDA", "reports": null }, { "id": "46b3c0fc-fa0c-4d63-a38a-b33a524561fb", "created_at": "2023-01-06T13:46:38.393409Z", "updated_at": "2026-04-10T02:00:02.955738Z", "deleted_at": null, "main_name": "APT29", "aliases": [ "Cloaked Ursa", "TA421", "Blue Kitsune", "BlueBravo", "IRON HEMLOCK", "G0016", "Nobelium", "Group 100", "YTTRIUM", "Grizzly Steppe", "ATK7", "ITG11", "COZY BEAR", "The Dukes", "Minidionis", "UAC-0029", "SeaDuke" ], "source_name": "MISPGALAXY:APT29", "tools": [ "SNOWYAMBER", "HALFRIG", "QUARTERRIG" ], "source_id": "MISPGALAXY", "reports": null }, { "id": "a97fee0d-af4b-4661-ae17-858925438fc4", "created_at": "2023-01-06T13:46:38.396415Z", "updated_at": "2026-04-10T02:00:02.957137Z", "deleted_at": null, "main_name": "Turla", "aliases": [ "TAG_0530", "Pacifier APT", "Blue Python", "UNC4210", "UAC-0003", "VENOMOUS Bear", "Waterbug", "Pfinet", "KRYPTON", "Popeye", "SIG23", "ATK13", "ITG12", "Group 88", "Uroburos", "Hippo Team", "IRON HUNTER", "MAKERSMARK", "Secret Blizzard", "UAC-0144", "UAC-0024", "G0010" ], "source_name": "MISPGALAXY:Turla", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "5cbf6c32-482d-4cd2-9d11-0d9311acdc28", "created_at": "2023-01-06T13:46:38.39927Z", "updated_at": "2026-04-10T02:00:02.958273Z", "deleted_at": null, "main_name": "ENERGETIC BEAR", "aliases": [ "BERSERK BEAR", "ALLANITE", "Group 24", "Koala Team", "G0035", "ATK6", "ITG15", "DYMALLOY", "TG-4192", "Crouching Yeti", "Havex", "IRON LIBERTY", "Blue Kraken", "Ghost Blizzard" ], "source_name": "MISPGALAXY:ENERGETIC BEAR", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d11c89bb-1640-45fa-8322-6f4e4053d7f3", "created_at": "2022-10-25T15:50:23.509601Z", "updated_at": "2026-04-10T02:00:05.277674Z", "deleted_at": null, "main_name": "Turla", "aliases": [ "Turla", "IRON HUNTER", "Group 88", "Waterbug", "WhiteBear", "Krypton", "Venomous Bear", "Secret Blizzard", "BELUGASTURGEON" ], "source_name": "MITRE:Turla", "tools": [ "PsExec", "nbtstat", "ComRAT", "netstat", "certutil", "KOPILUWAK", "IronNetInjector", "LunarWeb", "Arp", "Uroburos", "PowerStallion", "Kazuar", "Systeminfo", "LightNeuron", "Mimikatz", "Tasklist", "LunarMail", "HyperStack", "NBTscan", "TinyTurla", "Penquin", "LunarLoader" ], "source_id": "MITRE", "reports": null }, { "id": "2d06d270-acfd-4db8-83a8-4ff68b9b1ada", "created_at": "2022-10-25T16:07:23.477794Z", "updated_at": "2026-04-10T02:00:04.625004Z", "deleted_at": null, "main_name": "Cold River", "aliases": [ "Blue Callisto", "BlueCharlie", "Calisto", "Cobalt Edgewater", "Gossamer Bear", "Grey Pro", "IRON FRONTIER", "Mythic Ursa", "Nahr Elbard", "Nahr el bared", "Seaborgium", "Star Blizzard", "TA446", "TAG-53", "UNC4057" ], "source_name": "ETDA:Cold River", "tools": [ "Agent Drable", "AgentDrable", "DNSpionage", "LOSTKEYS", "SPICA" ], "source_id": "ETDA", "reports": null }, { "id": "730dfa6e-572d-473c-9267-ea1597d1a42b", "created_at": "2023-01-06T13:46:38.389985Z", "updated_at": "2026-04-10T02:00:02.954105Z", "deleted_at": null, "main_name": "APT28", "aliases": [ "Pawn Storm", "ATK5", "Fighting Ursa", "Blue Athena", "TA422", "T-APT-12", "APT-C-20", "UAC-0001", "IRON TWILIGHT", "SIG40", "UAC-0028", "Sofacy", "BlueDelta", "Fancy Bear", "GruesomeLarch", "Group 74", "ITG05", "FROZENLAKE", "Forest Blizzard", "FANCY BEAR", "Sednit", "SNAKEMACKEREL", "Tsar Team", "TG-4127", "STRONTIUM", "Grizzly Steppe", "G0007" ], "source_name": "MISPGALAXY:APT28", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "3a057a97-db21-4261-804b-4b071a03c124", "created_at": "2024-06-04T02:03:07.953282Z", "updated_at": "2026-04-10T02:00:03.813595Z", "deleted_at": null, "main_name": "IRON FRONTIER", "aliases": [ "Blue Callisto ", "BlueCharlie ", "CALISTO ", "COLDRIVER ", "Callisto Group ", "GOSSAMER BEAR ", "SEABORGIUM ", "Star Blizzard ", "TA446 " ], "source_name": "Secureworks:IRON FRONTIER", "tools": [ "Evilginx2", "Galileo RCS", "SPICA" ], "source_id": "Secureworks", "reports": null }, { "id": "e2a4bc0b-6745-4e55-9d7c-3d169d70b025", "created_at": "2022-10-25T16:07:23.386907Z", "updated_at": "2026-04-10T02:00:04.576815Z", "deleted_at": null, "main_name": "Berserk Bear", "aliases": [ "Berserk Bear", "Dragonfly 2.0", "Dymalloy", "G0074" ], "source_name": "ETDA:Berserk Bear", "tools": [ "Fuerboos", "Goodor", "Impacket", "Karagany", "Karagny", "LOLBAS", "LOLBins", "Living off the Land", "Phishery", "Trojan.Karagany", "Trojan.Phisherly", "xFrost" ], "source_id": "ETDA", "reports": null }, { "id": "e3767160-695d-4360-8b2e-d5274db3f7cd", "created_at": "2022-10-25T16:47:55.914348Z", "updated_at": "2026-04-10T02:00:03.610018Z", "deleted_at": null, "main_name": "IRON TWILIGHT", "aliases": [ "APT28 ", "ATK5 ", "Blue Athena ", "BlueDelta ", "FROZENLAKE ", "Fancy Bear ", "Fighting Ursa ", "Forest Blizzard ", "GRAPHITE ", "Group 74 ", "PawnStorm ", "STRONTIUM ", "Sednit ", "Snakemackerel ", "Sofacy ", "TA422 ", "TG-4127 ", "Tsar Team ", "UAC-0001 " ], "source_name": "Secureworks:IRON TWILIGHT", "tools": [ "Downdelph", "EVILTOSS", "SEDUPLOADER", "SHARPFRONT" ], "source_id": "Secureworks", "reports": null }, { "id": "ae320ed7-9a63-42ed-944b-44ada7313495", "created_at": "2022-10-25T15:50:23.671663Z", "updated_at": "2026-04-10T02:00:05.283292Z", "deleted_at": null, "main_name": "APT28", "aliases": [ "APT28", "IRON TWILIGHT", "SNAKEMACKEREL", "Group 74", "Sednit", "Sofacy", "Pawn Storm", "Fancy Bear", "STRONTIUM", "Tsar Team", "Threat Group-4127", "TG-4127", "Forest Blizzard", "FROZENLAKE", "GruesomeLarch" ], "source_name": "MITRE:APT28", "tools": [ "Wevtutil", "certutil", "Forfiles", "DealersChoice", "Mimikatz", "ADVSTORESHELL", "Komplex", "HIDEDRV", "JHUHUGIT", "Koadic", "Winexe", "cipher.exe", "XTunnel", "Drovorub", "CORESHELL", "OLDBAIT", "Downdelph", "XAgentOSX", "USBStealer", "Zebrocy", "reGeorg", "Fysbis", "LoJax" ], "source_id": "MITRE", "reports": null }, { "id": "20d3a08a-3b97-4b2f-90b8-92a89089a57a", "created_at": "2022-10-25T15:50:23.548494Z", "updated_at": "2026-04-10T02:00:05.292748Z", "deleted_at": null, "main_name": "APT29", "aliases": [ "APT29", "IRON RITUAL", "IRON HEMLOCK", "NobleBaron", "Dark Halo", "NOBELIUM", "UNC2452", "YTTRIUM", "The Dukes", "Cozy Bear", "CozyDuke", "SolarStorm", "Blue Kitsune", "UNC3524", "Midnight Blizzard" ], "source_name": "MITRE:APT29", "tools": [ "PinchDuke", "ROADTools", "WellMail", "CozyCar", "Mimikatz", "Tasklist", "OnionDuke", "FatDuke", "POSHSPY", "EnvyScout", "SoreFang", "GeminiDuke", "reGeorg", "GoldMax", "FoggyWeb", "SDelete", "PolyglotDuke", "AADInternals", "MiniDuke", "SeaDuke", "Sibot", "RegDuke", "CloudDuke", "GoldFinder", "AdFind", "PsExec", "NativeZone", "Systeminfo", "ipconfig", "Impacket", "Cobalt Strike", "PowerDuke", "QUIETEXIT", "HAMMERTOSS", "BoomBox", "CosmicDuke", "WellMess", "VaporRage", "LiteDuke" ], "source_id": "MITRE", "reports": null }, { "id": "d2516b8e-e74f-490d-8a15-43ad6763c7ab", "created_at": "2022-10-25T16:07:24.212584Z", "updated_at": "2026-04-10T02:00:04.900038Z", "deleted_at": null, "main_name": "Sofacy", "aliases": [ "APT 28", "ATK 5", "Blue Athena", "BlueDelta", "FROZENLAKE", "Fancy Bear", "Fighting Ursa", "Forest Blizzard", "G0007", "Grey-Cloud", "Grizzly Steppe", "Group 74", "GruesomeLarch", "ITG05", "Iron Twilight", "Operation DealersChoice", "Operation Dear Joohn", "Operation Komplex", "Operation Pawn Storm", "Operation RoundPress", "Operation Russian Doll", "Operation Steal-It", "Pawn Storm", "SIG40", "Sednit", "Snakemackerel", "Sofacy", "Strontium", "T-APT-12", "TA422", "TAG-0700", "TAG-110", "TG-4127", "Tsar Team", "UAC-0028", "UAC-0063" ], "source_name": "ETDA:Sofacy", "tools": [ "ADVSTORESHELL", "AZZY", "Backdoor.SofacyX", "CHERRYSPY", "CORESHELL", "Carberp", "Computrace", "DealersChoice", "Delphacy", "Downdelph", "Downrage", "Drovorub", "EVILTOSS", "Foozer", "GAMEFISH", "GooseEgg", "Graphite", "HATVIBE", "HIDEDRV", "Headlace", "Impacket", "JHUHUGIT", "JKEYSKW", "Koadic", "Komplex", "LOLBAS", "LOLBins", "Living off the Land", "LoJack", "LoJax", "MASEPIE", "Mimikatz", "NETUI", "Nimcy", "OCEANMAP", "OLDBAIT", "PocoDown", "PocoDownloader", "Popr-d30", "ProcDump", "PythocyDbg", "SMBExec", "SOURFACE", "SPLM", "STEELHOOK", "Sasfis", "Sedkit", "Sednit", "Sedreco", "Seduploader", "Shunnael", "SkinnyBoy", "Sofacy", "SofacyCarberp", "SpiderLabs Responder", "Trojan.Shunnael", "Trojan.Sofacy", "USB Stealer", "USBStealer", "VPNFilter", "Win32/USBStealer", "WinIDS", "Winexe", "X-Agent", "X-Tunnel", "XAPS", "XTunnel", "Xagent", "Zebrocy", "Zekapab", "carberplike", "certutil", "certutil.exe", "fysbis", "webhp" ], "source_id": "ETDA", "reports": null }, { "id": "f27790ff-4ee0-40a5-9c84-2b523a9d3270", "created_at": "2022-10-25T16:07:23.341684Z", "updated_at": "2026-04-10T02:00:04.549917Z", "deleted_at": null, "main_name": "APT 29", "aliases": [ "APT 29", "ATK 7", "Blue Dev 5", "BlueBravo", "Cloaked Ursa", "CloudLook", "Cozy Bear", "Dark Halo", "Earth Koshchei", "G0016", "Grizzly Steppe", "Group 100", "ITG11", "Iron Hemlock", "Iron Ritual", "Midnight Blizzard", "Minidionis", "Nobelium", "NobleBaron", "Operation Ghost", "Operation Office monkeys", "Operation StellarParticle", "SilverFish", "Solar Phoenix", "SolarStorm", "StellarParticle", "TEMP.Monkeys", "The Dukes", "UNC2452", "UNC3524", "Yttrium" ], "source_name": "ETDA:APT 29", "tools": [ "7-Zip", "ATI-Agent", "AdFind", "Agentemis", "AtNow", "BEATDROP", "BotgenStudios", "CEELOADER", "Cloud Duke", "CloudDuke", "CloudLook", "Cobalt Strike", "CobaltStrike", "CosmicDuke", "Cozer", "CozyBear", "CozyCar", "CozyDuke", "Danfuan", "EnvyScout", "EuroAPT", "FatDuke", "FoggyWeb", "GeminiDuke", "Geppei", "GoldFinder", "GoldMax", "GraphDrop", "GraphicalNeutrino", "GraphicalProton", "HAMMERTOSS", "HammerDuke", "LOLBAS", "LOLBins", "LiteDuke", "Living off the Land", "MagicWeb", "Mimikatz", "MiniDionis", "MiniDuke", "NemesisGemina", "NetDuke", "OnionDuke", "POSHSPY", "PinchDuke", "PolyglotDuke", "PowerDuke", "QUIETEXIT", "ROOTSAW", "RegDuke", "Rubeus", "SNOWYAMBER", "SPICYBEAT", "SUNSHUTTLE", "SeaDaddy", "SeaDask", "SeaDesk", "SeaDuke", "Sharp-SMBExec", "SharpView", "Sibot", "Solorigate", "SoreFang", "TinyBaron", "WINELOADER", "WellMail", "WellMess", "cobeacon", "elf.wellmess", "reGeorg", "tDiscoverer" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434122, "ts_updated_at": 1775792270, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/e975abe6e455787bd19b3dcee33f9d179e874ad4.pdf", "text": "https://archive.orkl.eu/e975abe6e455787bd19b3dcee33f9d179e874ad4.txt", "img": "https://archive.orkl.eu/e975abe6e455787bd19b3dcee33f9d179e874ad4.jpg" } }