IAmTheKing
IAmTheKing is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government, and Education and Research, in 3 countries, including Russia and Malaysia.
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Record updated
Who They Target.
About IAmTheKing.
On October 1, 2020, the DHS CISA agency released information about a malware family called SlothfulMedia, which they attribute to a sophisticated threat actor. We have been tracking this set of activity through our private reporting service, and we would like to provide the community with additional context. In June 2018, we published the first report on a new cluster of activities that we named IAmTheKing, based on malware strings discovered in a malware sample from an unknown family. Amusingly, other strings present inside of it invited “kapasiky antivirus” to “leave [them] alone”.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.