UNK_RemoteRogue
UNK_RemoteRogue is a suspected Russian threat group observed in late 2024 using the ClickFix social-engineering technique in espionage activity. Proofpoint reported the group targeted individuals at two organizations associated with or closely related to a major arms manufacturer in the defense industry, including two prominent arms manufacturing firms. The group sent lure emails from likely compromised Zimbra servers that linked to a spoofed Microsoft Office page. The landing page provided Russian-language ClickFix-style instructions, including prompting victims to copy code from the browser into a terminal, and in some reporting included a YouTube tutorial showing how to run PowerShell. The infection chain executed JavaScript and then PowerShell linked to the Empire command-and-control framework. Reporting also notes infrastructure overlap with another phishing campaign targeting defense and aerospace entities connected to the war in Ukraine to harvest webmail credentials through fake login pages. The content identifies the actor only as a suspected Russian group and does not provide additional confirmed aliases or sub-groups beyond UNK_RemoteRogue.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Military
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected Russian actor using ClickFix-style lures spoofing Microsoft Office to drive PowerShell/JavaScript execution and deploy Empire C2 against defense-industry-associated targets.
Russian state-linked activity cluster observed using ClickFix in campaigns targeting the defense industry.
Espionage targeting defense/arms manufacturing using ClickFix lures to drive JavaScript then PowerShell execution, leveraging Empire for post-exploitation.
Used ClickFix lures delivered from compromised Zimbra servers to drive victims to a fake Microsoft Word page (with Russian instructions and a YouTube tutorial) that executed JavaScript to launch PowerShell and connect to an Empire C2 server.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.