Threat actors by attributed origin

Romania-Attributed Threat Actors.

Brandefense tracks 2 threat actors attributed to Romania. The most documented are FIN4 and RUBYCARP. The sectors they target most are Finance, Healthcare and Legal.

Top target sectorsFinance Healthcare Legal

MotivationEspionage Financial Ideology

1 of 1 published profiles shown

Cards Table

FIN4Romania

aka WOLF SPIDER · G0085

CybercrimeFinancial

FIN4 is a Romania-attributed cybercrime syndicate with a financial motive. It targets 3 sectors, including Finance and Healthcare, in the United States.

On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.

Each profile includes the actor's origin, type, active date range, target sectors and countries, MITRE ATT&CK TTPs, related CVEs, malware and tools used, recent campaigns, and motivation. Full IOC feeds and YARA rules are available on the Brandefense platform.
Yes. ATLAS Threat Actors DB covers nation-state APT groups such as Lazarus Group, cybercrime syndicates such as Scattered Spider, and ransomware operations. All profiles are maintained by Brandefense analysts.
IOC feeds, YARA rules, and MITRE ATT&CK navigator exports are available through the full Brandefense platform. Request a demo to get access.

Romania-Attributed Threat Actors.

Common Questions.

What information is in an ATLAS threat actor profile?

Does ATLAS cover both APT groups and ransomware gangs?

How do I get IOC feeds and YARA rules for a specific threat actor?