Arra Ghouls
Arra Ghouls is a threat actor group, tracked by Brandefense. It targets 7 sectors, including Technology and Finance, in Russia and Belarus. It uses 30 MITRE ATT&CK techniques.
- Mimbrob
- Techniques
- 30
- Exploited CVEs
- No CVE data
- First seen
- Apr 22, 2026
- Last seen
- Sep 3, 2026
- Record updated
Who They Target.
About Arra Ghouls.
Arra Ghouls, also tracked as Mimbrob, is a threat group first documented in 2026 that initially attacked private individuals, stealing and monetizing their data with information stealers and banking trojans, and from April 2026 shifted to phishing campaigns against organizations in Russia and Belarus. Eighteen victim organizations were identified in the telecommunications, manufacturing (in particular pharmaceutical production), information technology, wholesale commerce and financial consulting sectors; phishing emails were also sent to an aircraft and rocket engine manufacturer, a research institute and IT companies.
Activity against organizations began in early April 2026; the earliest dated sample reported by one vendor is from 22 April 2026, a first phishing wave ran until 8 May 2026, and a new wave against IT companies began on 3 September 2026 and was still ongoing at the end of that month. One reporting vendor describes the group as cybercriminal, while another assesses, without having recovered a final payload, that its likely goal is espionage.
Last updated Nov 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.