Skip to content
Threat actors by attributed origin

Russia-Attributed Threat Actors.

Brandefense tracks 83 threat actors attributed to Russia. The most documented are APT28, Sandworm and APT29. The sectors they target most are Finance, Government and Manufacturing.

48 of 83 published profiles shown

RTMRussia
aka Redaman · RTM Locker · G0048
CybercrimeFinancial

RTM is a Russia-attributed cybercrime syndicate with a financial motive.

22TTPs
7exploited
13malware
ModerateProfile →
Void RabisuRussia
aka Storm-0978 · Tropical Scorpius · RomCom
UnclassifiedIdeology

Void Rabisu is a Russia-attributed threat actor group with an ideological motive. It targets 3 sectors, including Government and Technology.

23TTPs
3exploited
10malware
AdvancedProfile →
NovaRussia
aka nova Team · Ransomware Operators · Nova affiliate program management
RansomwareFinancial

Nova is a Russia-attributed ransomware group with a financial motive.

25TTPs
–No CVE data
21malware
AdvancedProfile →
UNC6353Russia
UnclassifiedIdeology

UNC6353 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

24TTPs
–No CVE data
5malware
ExpertProfile →
DustSquadRussia
aka APTC34 · Nomadic Octopus
Nation-state APTEspionage

DustSquad is a Russia-attributed nation-state APT group with an espionage motive.

23TTPs
–No CVE data
2malware
AdvancedProfile →
OldGremlinRussia
Nation-state APTEspionage

OldGremlin is a Russia-attributed nation-state APT group with an espionage motive. It targets 6 sectors, including Manufacturing and Finance, in Russia.

18TTPs
–No CVE data
18malware
AdvancedProfile →
UAC-0099Russia
UnclassifiedIdeology

UAC-0099 is a Russia-attributed threat actor group with an ideological motive.

17TTPs
–No CVE data
17malware
IntermediateProfile →
UAC-0247Russia
UnclassifiedIdeology

UAC-0247 is a Russia-attributed threat actor group with an ideological motive. It targets organisations in Ukraine. It uses 15 MITRE ATT&CK techniques.

15TTPs
–No CVE data
23malware
IntermediateProfile →
FIN5Russia
aka G0053
CybercrimeFinancial

FIN5 is a Russia-attributed cybercrime syndicate with a financial motive.

12TTPs
–No CVE data
8malware
ModerateProfile →
TAG-195Russia
aka Golden Chickens · Venom Spider · TA4557
CybercrimeFinancial

TAG-195 is a Russia-attributed cybercrime syndicate with a financial motive. It targets 4 sectors, including Finance and Healthcare, in the United States.

6TTPs
–No CVE data
15malware
AdvancedProfile →
UNKKRussia
CybercrimeFinancial

UNKK is a Russia-attributed cybercrime syndicate with a financial motive. It targets the Finance sector in 6 countries, including France and Canada.

6TTPs
–No CVE data
5malware
AdvancedProfile →
UAC-0244Russia
UnclassifiedIdeology

UAC-0244 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
UAC-0263Russia
UnclassifiedIdeology

UAC-0263 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
UAC-0184Russia
aka Hive0156
UnclassifiedIdeology

UAC-0184 is a Russia-attributed threat actor group with an ideological motive. It targets organisations in Ukraine. It uses 6 MITRE ATT&CK techniques.

6TTPs
–No CVE data
11malware
IntermediateProfile →
UAC-0277Russia
CybercrimeFinancial

UAC-0277 is a Russia-attributed cybercrime syndicate with a financial motive. It targets the Business Services, and Retail and Consumer sectors in Russia and Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
UAT-10820Russia
CybercrimeFinancial

UAT-10820 is a Russia-attributed cybercrime syndicate with a financial motive. It targets the Government and Technology sectors in Ukraine.

6TTPs
–No CVE data
3malware
AdvancedProfile →
UAC-0145Russia
UnclassifiedUnknown

UAC-0145 is a Russia-attributed threat actor group. It targets the Technology sector. It uses 5 MITRE ATT&CK techniques.

5TTPs
–No CVE data
4malware
Not ratedProfile →
HotejkaRussia
aka ROI777
CybercrimeFinancial

Hotejka is a Russia-attributed cybercrime syndicate with a financial motive. It targets organisations in Russia. It uses 5 MITRE ATT&CK techniques.

5TTPs
–No CVE data
1malware
IntermediateProfile →
GTG-20006Russia
aka Russia-linked espionage
UnclassifiedIdeology

GTG-20006 is a Russia-attributed threat actor group with an ideological motive. It targets the Hospitality and Tourism sector. It uses 4 MITRE ATT&CK techniques.

4TTPs
–No CVE data
1malware
AdvancedProfile →
ALLANITERussia
aka Palmetto Fusion · G1000
Nation-state APTEspionage

ALLANITE is a Russia-attributed nation-state APT group with an espionage motive. It targets the Energy and Utilities sector in the United States and the United Kingdom.

4TTPs
–No CVE data
5malware
AdvancedProfile →
Russian intelligence agenciesRussia
aka Moscow's agents · Russian agents
UnclassifiedIdeology

Russian intelligence agencies is a Russia-attributed threat actor group with an ideological motive.

4TTPs
–No CVE data
0malware
AdvancedProfile →
GCMANRussia
aka G0036
CybercrimeFinancial

GCMAN is a Russia-attributed cybercrime syndicate with a financial motive. It targets the Finance sector in Russia. It uses 3 MITRE ATT&CK techniques.

3TTPs
–No CVE data
4malware
IntermediateProfile →
LUNAR SPIDERRussia
aka Gold SwathMore
CybercrimeFinancial

LUNAR SPIDER is a Russia-attributed cybercrime syndicate with a financial motive. It targets the Technology and Finance sectors. It uses 1 MITRE ATT&CK technique.

1TTPs
–No CVE data
4malware
AdvancedProfile →
TeamSpy CrewRussia
aka SIG39 · Iron Lyric · Team Bear +1
Nation-state APTEspionage

TeamSpy Crew is a Russia-attributed nation-state APT group with an espionage motive.

0TTPs
–No CVE data
2malware
Not ratedProfile →
← Previous page
On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.