FIRMACHAGENT
FIRMACHAGENT is a malware family used by the espionage actor TEMP.Vermin, which Ukraine’s CERT-UA has linked to security agencies of the so-called Luhansk People’s Republic (LPR/LNR). Google Threat Intelligence Group reporting places it alongside VERMONSTER and SPECTRUM (also reported publicly as Spectr) in TEMP.Vermin operations. The malware has been deployed via lure content themed around drone production and development, anti-drone defense systems, and video surveillance security systems. Supporting reporting characterizes these operations as surveillance-focused and tied to drone/anti-drone operations. The activity is associated with Russian-linked targeting connected to the Russia-Ukraine war and broader targeting of defense-related entities, particularly organizations and personnel involved in unmanned aircraft systems and related battlefield technologies. No specific technical indicators of compromise or detailed functionality for FIRMACHAGENT are provided in the available content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TEMP.Vermin, an espionage actor whose activity Ukraine's Computer Emergency Response Team (CERT-UA) has linked to security agencies of the so-called Luhansk People's Republic (LPR, also rendered as LNR), has deployed malware including VERMONSTER, SPECTRUM (publicly reported as Spectr), and FIRMACHAGENT via the use of lure content themed around drone production and development, anti-drone defense systems, and video surveillance security systems.
"TEMP.Vermin ... has used malware like VERMONSTER, SPECTRUM (aka SPECTR), and FIRMACHAGENT..."
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used for surveillance and drone/anti-drone operations in battlefield contexts.
Malware used by TEMP.Vermin in campaigns leveraging defense/drone-related lure content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.