Loading threat actor…
Himera is a Russian-language probiv service operating in the illicit market for traded personal data. It has been identified as a well-known broker platform within the broader Russian ecosystem that facilitates access to leaked or illicitly obtained personal information. Reporting indicates the service was previously known to cooperate with Russian law enforcement, but later stated that it had ended law-enforcement access and relocated its staff abroad amid increased pressure on the probiv market. Himera is best characterized as a criminal data-broker operation rather than a conventional intrusion set or espionage group. Available high-confidence information supports its role in enabling the acquisition and resale of sensitive personal data, but does not provide sufficient detail to attribute specific intrusion tradecraft, malware usage, or ransomware activity to the service.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.