NGC5081
NGC5081 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Technology and Telecommunications sectors in Russia. It uses 11 MITRE ATT&CK techniques and exploits 1 known CVE.
- Techniques
- 11
- Exploited CVEs
- 1
- First seen
- Jan 1, 2024
- Last seen
- Jul 1, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
11 techniques across 7 of 14 tacticsReconnaissance1
Active Scanning: Vulnerability Scanning
Resource Development1
Trusted Relationship
Initial Access4
Remote Services: SSH
Valid Accounts
Exploit Public-Facing Application
Server Software Component: Web Shell
Execution·
Persistence1
Compromise Host Software Binary
Privilege Escalation1
Exploitation for Privilege Escalation
Defense Evasion2
Masquerading: Match Legitimate Resource Name or Location
Indicator Removal: Clear Linux or Mac System Logs
Credential Access1
Brute Force
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Vulnerabilities They Exploit.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- IDFKAmalware
- IDFKA Droppermalware
- Tiny SHellmalware
- ReverseSSHtool
Indicators Of Compromise.
TLP:AMBER4 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout NGC5081.
NGC5081 is an unattributed, espionage-oriented intrusion group that has targeted organizations in Russia, including telecommunications providers and an IT-services contractor whose trusted access it abused to reach client database clusters. Public reporting describes dwell times ranging from ten months to more than two years, entry through vulnerable internet-facing web services, lateral movement with legitimate credentials and SSH, systematic log tampering, and process and file masquerading tailored to each compromised system. Its primary tool is IDFKA, a custom Rust-based Linux backdoor with ICMP, TCP, UDP, HTTP and other covert channels, complemented by Tiny SHell, reverse shells and, since 2025, trojanized system utilities used as droppers for persistence.
Activity has been observed from at least January 2024 through July 2026; these dates are reported at month-level precision. The group is assessed as highly capable and focused on stealth. No attribution to a country or known group has been established, and linguistic artifacts in the malware suggesting a Spanish- or Romance-language-speaking developer are not evidence of origin.
Last updated Oct 27, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.