InvisiMole
InvisiMole is a threat actor uncovered by ESET in 2018. The provided content identifies the aliases InvisiMole and Storm-0593. It has operated against Ukrainian targets and has been observed in relation to compromises involving the Russia-aligned Gamaredon group; the content states that InvisiMole attacked select systems that Gamaredon had earlier compromised and fingerprinted, that Gamaredon has shared access with InvisiMole, and that in 2020 Gamaredon infrastructure was used by the InvisiMole group. Reported tradecraft includes disguising droppers as legitimate software or documents and saving files as mpr.dll in the Windows folder; using Windows services to execute payloads; using TCP to download additional modules; compressing data intended for exfiltration with WinRAR; removing all system restore points; leveraging the ListPlanting technique to inject malicious code into legitimate processes; and installing legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution. The content also states that InvisiMole used the BYOVD technique, exploiting the MSR vulnerability in speedfan.sys (CVE-2007-5633) to load a malicious unsigned driver, and that a newer variant on Windows 10 x64 bypassed mitigations such as SMEP and SMAP.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actor previously observed collaborating with Gamaredon.
Mentioned as another actor that has historically received shared access from Gamaredon (no additional operational details provided in this content).
Actor previously observed using Gamaredon infrastructure (2020), indicating operational overlap or infrastructure sharing among Russian-aligned actors.
Conducts targeted follow-on intrusions against select systems previously compromised/fingerprinted by Gamaredon.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.