COLDRIVER: Russian Hacking Group
COLDRIVER is a Russian hacking group known for phishing campaigns targeting opposition figures and human rights activists. The group was mentioned in…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
RomCom: Russian Hacking Group
RomCom is a Russian hacking group that has exploited CVE-2025-8088, a WinRAR vulnerability, in attacks targeting Ukraine. They are known for cyber…
Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Google Threat Intelligence Group (GTIG) has attributed a previously undocumented .NET backdoor named STOCKSTAY to the Russian state-sponsored threat actor Turla. The…
Turla Backdoor Activity Resurfaces in Recent Campaigns
The Russian-linked Turla APT group has been deploying backdoors in new campaigns, continuing its long-standing espionage operations.
Sandworm: GRU-Linked Advanced Hacking Unit
Sandworm is a Russian state-sponsored hacking group associated with the GRU, known for destructive cyber attacks. UAC-0145 is a sub-cluster within Sandworm.
Gamaredon: Russian APT Targeting Ukraine
Gamaredon is a Russian advanced persistent threat group that has been highly active against Ukrainian governmental and military institutions, using spear-phishing, custom…
MuddyWater Threat Actor
MuddyWater is an Iranian state-sponsored cyber espionage group known for targeting government and private sectors in the Middle East and elsewhere. It…
OceanLotus Targets Vietnam Investors With SPECTRALVIPER in FireAnt Supply Chain Attack
ESET has uncovered two campaigns by the Vietnam-aligned threat actor OceanLotus (APT32) targeting domestic entities and stock investors with the SPECTRALVIPER backdoor.…
OceanLotus (APT32) Threat Actor Profile
OceanLotus, also known as APT32, is a Vietnam-aligned advanced persistent threat group active since 2012. It has historically targeted foreign entities, including…
APT32 — Attack group profile
APT32 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…