Loading story…
Russian-speaking threat group OldGremlin carried out a series of ransomware and spearphishing attacks against organizations in Russia, an unusual targeting pattern for a financially motivated group operating in the region. Group-IB linked at least seven phishing campaigns since spring 2020 to the actor, with lures tied to COVID-19, media outreach, and the Belarus protests, while impersonating entities including RBC, SRO MiR, Novadent, Minsk Tractor Works, and a metallurgical company. Reported victims included a large medical company as well as banks and industrial firms.
In one documented intrusion, attackers used a phishing email masquerading as RBC to gain initial access, then deployed custom malware including TinyNode and TinyPosh, followed by Cobalt Strike for post-exploitation. The group established persistence through registry run keys, executed PowerShell and JScript, stole credentials, moved laterally over RDP and SMB, wiped backups, and finally encrypted the network with TinyCryptor ransomware. Group-IB said the operation also used Tor-based command-and-control infrastructure, APC-based process injection, and RC4-encrypted communications, aligning the activity with multiple MITRE ATT&CK techniques.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
On August 19, 2020, CERT-GIB detected OldGremlin campaigns targeting Russian financial organizations with emails impersonating Minsk Tractor Works. The lures referenced protests and strikes in Belarus.
On August 13 and 14, 2020, CERT-GIB tracked two large-scale OldGremlin campaigns impersonating RBC and a mining and metallurgical company. Around 250 malicious emails were sent to Russian companies in the financial and industrial sectors during the two days.
In a documented August 2020 incident, OldGremlin gained initial access to a large Russian medical company through a phishing email impersonating RBC with the subject line "Bill due." The intrusion deployed custom malware including TinyNode and led to broader post-exploitation activity.
On April 24, 2020, OldGremlin conducted a phishing attack impersonating the dental clinic Novadent. The campaign was part of the group's broader use of themed social engineering to deliver malware.
Group-IB estimated that OldGremlin conducted at least seven phishing campaigns starting in spring 2020. Early lures used COVID-19 themes and impersonated organizations including SRO MiR.
Group-IB first detected OldGremlin activity between late March and early April 2020. The early activity marked the emergence of a Russian-speaking ransomware group targeting organizations in Russia.
Three weeks after the initial infection, OldGremlin encrypted the medical company's entire corporate network, disrupting operations and demanding $50,000 in cryptocurrency. Before ransomware deployment, the attackers had moved laterally, obtained domain administrator credentials, and wiped backups.
About two weeks after the April 24 campaign, OldGremlin sent phishing emails posing as an RBC journalist inviting bank employees to a coronavirus-related survey interview. The attackers used Calendly and a follow-up cloud-upload message to make the lure appear legitimate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026
Researchers detailed two active Russia-linked threat operations using different intrusion models to target Western organizations. **TA577**, a phishing group active since 2020, was observed sending HTML attachments that force outbound SMB connections to `file://` URLs in order to capture **NTLMv2** authentication handshakes and steal credential hashes. Infrastructure hunting tied the campaign to a narrowed set of likely servers identified through Impacket-like 8-character SMB target names, a distinctive SMB server GUID, shared SSH banner hashes, and recurring hosting patterns across providers including **GLOBALWAYS**; some hosts also exposed a **"We’ll back soon.."** page, login panels, or default Apache pages. A separate analysis examined **NoName057(16)**, a pro-Russian hacktivist collective that has sustained disruptive attacks against Western targets, especially Italian banks, government entities, military infrastructure, and public administrations. The group operates a volunteer-driven DDoS ecosystem known as **DDosia** or **People Go Stresser 2.0**, combining attack tools, support channels, operational guidance, and cryptocurrency rewards to coordinate participants. Its operations primarily use Layer 7 HTTP floods and Layer 4 TCP-SYN attacks, with most traffic aimed at **TLS/443** services but also hitting SSH, FTP, and secure email ports; researchers also noted prior links between the collective and **Bobik RAT** infections used to support DDoS activity.
Jul 12, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026