DENOmination Group
DENOmination Group is a threat actor group, tracked by Brandefense. It targets 3 sectors, including Finance, and Defense and Aerospace, in Russia. It uses 34 MITRE ATT&CK techniques.
- Techniques
- 34
- Exploited CVEs
- No CVE data
- First seen
- Mar 26, 2026
- Last seen
- Aug 26, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
34 techniques across 9 of 14 tacticsArsenal · Malware And Tools.
- DenoRATmalware
- Tsunderemalware
- Denotool
Indicators Of Compromise.
TLP:CLEAR- IP
188[.]253[.]24[.]154 - IP
46[.]29[.]166[.]104
15 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout DENOmination Group.
DENOmination Group is a hacker group first documented in 2026 that attacked Russian defense industry enterprises, military organizations, banks and other financial and consulting organizations with phishing lures on financial, credit and military topics. The name covers a specific activity cluster aimed at Russian organizations, linked by overlapping network infrastructure, infection chain logic, code base and configuration parameters; it does not refer to the developers of its malware or to every operator of that toolkit, which is also used by other tracked clusters and is assessed as possibly offered as malware-as-a-service or another form of multi-tenant platform. The reporting vendor found insufficient data to attribute the group to any previously known actor.
Dated activity runs from 26 March 2026, the start of the earliest dated period of the installer package branch, to at least 26 August 2026, when the latest command-and-control pool was still in use. The group's defining technique is the abuse of the legitimate Deno JavaScript and TypeScript runtime, launched with full permissions, to execute obfuscated malicious JavaScript and fetch later stages from its servers.
Last updated Nov 13, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.