Agenda ransomware — Attack group profile
Agenda ransomware was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Stealth Falcon: Cyber Espionage Group
A threat actor documented by Check Point, associated with the WebDAV hijack technique (CVE-2025-33053) used in this campaign.
Russian Intelligence Hijacks IP Cameras Across NATO and Ukraine for Military Espionage
At least one Russian intelligence service is systematically hijacking internet-connected security cameras across Europe and Ukraine to spy on military logistics, according…
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A solo Russian-speaking threat actor known as "bandcampro" has been observed using Google's open-source Gemini CLI AI to control a botnet of…
bandcampro: Russian-Speaking Threat Actor Using AI for Cybercrime
A solo Russian-speaking threat actor known as bandcampro has been observed using Google Gemini CLI to control a botnet of eight dental…
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
Russian state-sponsored threat actors from the UAC-0145 sub-cluster, linked to Sandworm and GRU, are using fake CAPTCHA checks on compromised websites to…
UAC-0145: Russian Sub-Cluster Linked to Sandworm
UAC-0145 is a sub-cluster within the Sandworm advanced hacking unit, affiliated with Russia's GRU. It has been attributed by CERT-UA to campaigns…
GRU: Russian Foreign Military Intelligence Agency
The GRU is Russia's primary foreign military intelligence agency, which sponsors advanced hacking units like Sandworm and its sub-clusters such as UAC-0145.
UTA0533: Threat Actor Exploiting SonicWall SMA Zero-Days
A previously undocumented threat actor tracked by Volexity, observed exploiting multiple zero-day vulnerabilities in SonicWall SMA VPN appliances to gain root access.
SuccessKey Threat Actor Behind ViteVenom and ChainVeil Campaigns
SuccessKey is the threat actor attributed to the ViteVenom and ChainVeil campaigns, which use blockchain-based C2 infrastructure to deliver remote access trojans…