InvisiMole

Also known as: Hive0051, InvisiMole, Storm-0593, UAC-0035

Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.

🌍 Country Russia
🎯 Incident Type Espionage
Government

Targeted Victims

Ukraine

Associated Operations

2019 Late 2022-03 ESET researchers reveal the modus operandi of the elusive InvisiMole group Ukraine warns of InvisiMole attacks tied to state-sponsored Russian hackers https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/ https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/ including newly discovered ties with the Gamaredon group

Introduction

Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.

Activities and Tactics

Targeted Sectors: Government

Country of Origin: 🇷🇺 Russia

Incident Type: Espionage

Suspected Victims: Ukraine

Notable Campaigns

  • 2019 Late
  • 2022-03
  • ESET researchers reveal the modus operandi of the elusive InvisiMole group
  • Ukraine warns of InvisiMole attacks tied to state-sponsored Russian hackers
  • https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/
  • https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/
  • including newly discovered ties with the Gamaredon group

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • InvisiMole:

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

References pending cataloguing.