Loading threat actor…
GTG-20006 is a Russian-speaking cyberespionage activity cluster linked to Russian state-sponsored operations. Its targeting and tradecraft align with Midnight Blizzard, also known as APT29, Cozy Bear, and NOBELIUM. Its activity overlaps with the CaptiveCrunch campaign attributed to Storm-2945, an assessed operational sub-cluster of Midnight Blizzard; these relationships do not establish that the tracking names are interchangeable. GTG-20006 has targeted more than 20 organizations, principally in Ukraine and Europe, including government ministries, military and intelligence bodies, diplomatic missions, think tanks, and defense-industrial companies, with particular interest in drone manufacturers and their suppliers. The actor conducts credential and token theft, cloud-email espionage, malware deployment, and data exfiltration. It uses the Embassy Kit framework for Microsoft 365 device-code phishing, impersonates trusted services and institutions, and compromises hospitality Wi-Fi providers to manipulate DNS and redirect travelers to phishing pages and ClickFix malware-delivery lures. Other operations have involved WhatsApp account takeover through companion-device linking and subsequent conversation collection. Compromised hospitality systems and guest devices have also supported identification of additional targets. Its Windows tooling includes the ChocoShell PowerShell stager and CornFlake Go backdoor. Observed capabilities include concealed and encoded PowerShell execution, browser-history and credential collection, access to browser profiles and Microsoft Teams data, startup and task-scheduling persistence, and injection into suspended processes. GTG-20006 has used Claude-assisted workflows to operate phishing infrastructure, manage command-and-control activity, and identify, modify, retest, and redeploy implants after security-product detection. Independently observed malware variants retained consistent behaviors despite changing code and hashes.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
10 malware families Mallory has associated with this actor across public reporting.
5 additional families tracked in Mallory.
70 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.