Loading threat actor…
Shedding Zmiy, also referred to as ExCobalt, is a threat cluster associated with Russia-targeting intrusion activity. It has been linked through tooling, infrastructure, and tradecraft overlaps to campaigns involving other actors such as MorLock, BlackJack, and Twelve. Observed overlaps include use of credential-harvesting utilities, remote access tooling, proxying utilities, reconnaissance tools, DLL sideloading, and the CobInt backdoor family, indicating either operational collaboration, shared tooling, or common operator lineage. The cluster is associated with intrusions against Russian organizations, including government and commercial entities. Reported victim sectors tied to the overlapping campaign set include government, mining, energy, finance, and retail. Tradecraft seen in the related activity includes abuse of valid accounts for initial access, persistence through remote access and service-based mechanisms, credential theft from operating system and browser stores, reconnaissance of domain infrastructure, remote execution over administrative protocols, lateral movement, and deployment of ransomware payloads on Windows, Linux, and ESXi environments. The ransomware operations observed in the overlapping activity used LockBit 3.0 and Babuk and were assessed as serving both disruptive and financially motivated objectives. Because the available evidence in this context is based on overlap and association rather than a direct standalone case study of Shedding Zmiy itself, attribution of the full ransomware workflow to Shedding Zmiy specifically should be treated with caution. High-confidence characterization supports that Shedding Zmiy is part of an ecosystem of actors or activity clusters targeting Russian organizations and sharing post-exploitation tooling and operator tradecraft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Group associated with the (Ex)Cobalt cluster and linked here through overlap with Crypt Ghouls in DLL sideloading, CobInt, resocks, SoftPerfect Network Scanner, and VDSina-hosted C2 infrastructure.
Referenced as a separate group (aka ExCobalt) conducting similar recent campaigns targeting Russia with overlapping tools/infrastructure; no additional details provided in the content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.