Introduction
These are reported APT activities attributed to a country, but not to an individual threat group.
Activities and Tactics
Country of Origin: 🇷🇺 [“Russia”]
Notable Campaigns
- 2014
- 2018-06
- 2022-06
- 2022-10
- 2024-07
- 2024-11
- 2025-04
- Medibank cyber incident
- Poland to probe Russia-linked cyberattack on state news agency
- Pro-Russian hackers blamed for water dam sabotage in Norway
- Russian Attacks Against Singapore Spike During Trump-Kim Summit
- Russian hackers may be behind Texas natural gas plant explosion: report
- Seoul accuses pro-Kremlin hackers of attacking websites over decision to monitor North Korean troops in Ukraine
- Yahoo hit with a Massive 500 Million Account Data Breach
- https://americanmilitarynews.com/2022/06/russian-hackers-may-be-behind-texas-natural-gas-plant-explosion-report/
- https://therecord.media/poland-cyberattack-investigation-state-agency
- https://therecord.media/seoul-accuses-pro-kremlin-hackers-of-attacking-websites-ukraine
- https://www.bankinfosecurity.com/medibank-hackers-dump-stolen-on-dark-web-a-20604
- https://www.bleepingcomputer.com/news/business/yahoo-hit-with-a-massive-500-million-account-data-breach/
- https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/
- https://www.f5.com/labs/articles/threat-intelligence/russian-attacks-against-singapore-spike-during-trump-kim-summit
- https://www.medibank.com.au/livebetter/newsroom/post/medibank-cyber-incident
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Information pending cataloguing.
Attribution and Evidence
Country of Origin: [“Russia”] Additional attribution information pending cataloguing.
References
References pending cataloguing.