Skip to content
Threat actors by targeted country

Threat Actors Targeting Ukraine.

Brandefense tracks 105 threat actors known to target Ukraine. The most documented are Kimsuky, APT28 and Lazarus Group. The sectors they target most are Government, Finance, and Defense and Aerospace.

24 of 28 published profiles shown

KimsukySouth Korea
aka Black Banshee · Velvet Chollima · Emerald Sleet +5
Nation-state APTIdeology

Kimsuky is a South Korea-attributed nation-state APT group with an ideological motive.

267TTPs
23exploited
166malware
AdvancedProfile →
APT28Russia
aka Strontium · Group 74 · Fancy Bear +25
Nation-state APTIdeology

APT28 is a Russia-attributed nation-state APT group with an ideological motive.

228TTPs
48exploited
143malware
StrategicProfile →
SandwormRussia
aka Russia-linked APT · APT44 · Sandworm (APT44) +2
UnclassifiedIdeology

Sandworm is a Russia-attributed threat actor group with an ideological motive.

215TTPs
36exploited
98malware
AdvancedProfile →
APT29Russia
aka Cozy Bear · Midnight Blizzard · Nobelium +25
Nation-state APTIdeology

APT29 is a Russia-attributed nation-state APT group with an ideological motive.

210TTPs
27exploited
103malware
StrategicProfile →
APT35Iran
aka COBALT ILLUSION · ITG18 · Phosphorus +4
Nation-state APTIdeology

APT35 is an Iran-attributed nation-state APT group with an ideological motive.

179TTPs
50exploited
129malware
AdvancedProfile →
MuddyWaterIran
aka Boggy Serpens · Earth Vetala · MERCURY +15
Nation-state APTIdeology

MuddyWater is an Iran-attributed nation-state APT group with an ideological motive.

188TTPs
27exploited
186malware
AdvancedProfile →
Mustang PandaChina
aka TA416 · RedDelta · BRONZE PRESIDENT +8
Nation-state APTIdeology

Mustang Panda is a China-attributed nation-state APT group with an ideological motive.

175TTPs
13exploited
106malware
AdvancedProfile →
FSB Centre 16Russia
aka TEMP.Isotope · DYMALLOY · Berserk Bear +16
Nation-state APTIdeology

FSB Centre 16 is a Russia-attributed nation-state APT group with an ideological motive.

116TTPs
14exploited
67malware
AdvancedProfile →
GamaredonRussia
aka IRON TILDEN · Primitive Bear · ACTINIUM +6
Nation-state APTIdeology

Gamaredon is a Russia-attributed nation-state APT group with an ideological motive.

108TTPs
5exploited
58malware
AdvancedProfile →
SideWinderPakistan
aka Rattlesnake · T-APT-04 · APT-C-17 +8
Nation-state APTIdeology

SideWinder is a Pakistan-attributed nation-state APT group with an ideological motive.

99TTPs
6exploited
54malware
AdvancedProfile →
TA446Russia
aka Seaborgium · Callisto · Callisto Group +5
Nation-state APTIdeology

TA446 is a Russia-attributed nation-state APT group with an ideological motive.

70TTPs
6exploited
23malware
AdvancedProfile →
Laundry BearRussia
Nation-state APTIdeology

Laundry Bear is a Russia-attributed nation-state APT group with an ideological motive. It targets 8 sectors, including Government and Technology, in Ukraine.

33TTPs
1exploited
11malware
AdvancedProfile →
NoName057(16)Russia
aka 05716nnm · Nnm05716 · NoName057
UnclassifiedIdeology

NoName057(16) is a Russia-attributed threat actor group with an ideological motive.

33TTPs
–No CVE data
2malware
ModerateProfile →
SloppyLemming
aka Outrider Tiger · Fishing Elephant
UnclassifiedIdeology

SloppyLemming is a threat actor group with an ideological motive. It targets the Government sector in 5 countries, including China and Türkiye.

27TTPs
–No CVE data
13malware
AdvancedProfile →
UNC6353Russia
UnclassifiedIdeology

UNC6353 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

24TTPs
–No CVE data
5malware
ExpertProfile →
UAC-0099Russia
UnclassifiedIdeology

UAC-0099 is a Russia-attributed threat actor group with an ideological motive.

17TTPs
–No CVE data
17malware
IntermediateProfile →
UAC-0247Russia
UnclassifiedIdeology

UAC-0247 is a Russia-attributed threat actor group with an ideological motive. It targets organisations in Ukraine. It uses 15 MITRE ATT&CK techniques.

15TTPs
–No CVE data
23malware
IntermediateProfile →
Infrastructure Destruction Squad
aka Dark Engine
UnclassifiedIdeology

Infrastructure Destruction Squad is a threat actor group with an ideological motive. It targets organisations in 4 countries, including Russia and Vietnam.

12TTPs
3exploited
3malware
IntermediateProfile →
GhostWriterBelarus
aka Storm-0257 · UNC1151 · FrostyNeighbor +3
UnclassifiedIdeology

GhostWriter is a Belarus-attributed threat actor group with an ideological motive.

10TTPs
–No CVE data
22malware
AdvancedProfile →
0xfay
UnclassifiedIdeology

0xfay is a threat actor group with an ideological motive.

7TTPs
–No CVE data
0malware
MinimalProfile →
UAC-0244Russia
UnclassifiedIdeology

UAC-0244 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
UAC-0263Russia
UnclassifiedIdeology

UAC-0263 is a Russia-attributed threat actor group with an ideological motive. It targets 5 sectors, including Government, and Defense and Aerospace, in Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
UAC-0184Russia
aka Hive0156
UnclassifiedIdeology

UAC-0184 is a Russia-attributed threat actor group with an ideological motive. It targets organisations in Ukraine. It uses 6 MITRE ATT&CK techniques.

6TTPs
–No CVE data
11malware
IntermediateProfile →
Hacking CatUkraine
UnclassifiedIdeology

Hacking Cat is an Ukraine-attributed threat actor group with an ideological motive. It targets the Government, and Energy and Utilities sectors in Russia and Ukraine.

6TTPs
–No CVE data
3malware
IntermediateProfile →
On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.