Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Lifting Zmiy

Lifting Zmiy is a threat actor group, tracked by Brandefense. It targets the Government and Telecommunications sectors in Russia.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Oct 1, 2023
Record updated

Who They Target.

Sectors · 2
Countries · 1

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited…ExploitedcriticalCVE-2022-1388F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.ExploitedcriticalCVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.ExploitedcriticalCVE-2024-8963Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality.ExploitedcriticalCVE-2021-4034The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.ExploitedhighCVE-2024-8190Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin…ExploitedhighCVE-2024-9379Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated…ExploitedhighCVE-2020-1472Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a…ExploitedmediumCVE-2024-9381A path traversal vulnerability in CSA versions below 5.0.2.high

Arsenal · Malware And Tools.

  • ReverseSSHmalware

About Lifting Zmiy.

Rostelecom's security team has discovered a new APT group that is breaching companies via industrial PLCs. Named Lifting Zmiy, the group's first attacks were traced back to October 2023. The group targeted PLCs from Russian company Tech-Automatics usually used with elevators and which were still using their default passwords. Rostelecom has linked the group to intrusions at a Russian government contractor, two telecom operators, and an IT company. The company says the group collected and exfiltrated data and then destroyed the victim's infrastructure. Rostelecom says Lifting Zmiy uses Starlink infrastructure for attacks and appears to operate out of Eastern Europe.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.