TeleBots
TeleBots is a Russia-attributed threat actor group, tracked by Brandefense. It targets the Finance, and Transportation and Logistics sectors in Ukraine.
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2015
- Record updated
Who They Target.
About TeleBots.
We believe that the main goal of attackers using these tools is cybersabotage. This blog post outlines the details about the campaign that we discovered. We will refer to the gang behind the malware as TeleBots. However it’s important to say that these attackers, and the toolset used, share a number of similarities with the BlackEnergy group, which conducted attacks against the energy industry in Ukraine in December 2015 and January 2016. In fact, we think that the BlackEnergy group has evolved into the TeleBots group. This group appears to be closely associated with, or evolved from, 'Sandworm Team, Iron Viking, Voodoo Bear'.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.